guardian[.]security-bot[.]cc

PhishDestroy identifies guardian.security-bot.cc as an active generic phishing domain, currently impersonating the Cloudflare brand to deceive users. The site displays a 'Suspected phishing site | Cloudflare' page title, indicating it attempts to mimic Cloudflare's security warnings to harvest credentials or spread malware. No specific drainer kit has been identified, but the domain's behavior aligns with credential theft and brand impersonation tactics.

Technical indicators from the investigation are precise: VirusTotal reports 2 out of 95 security vendors flagging this domain as malicious. The domain was registered through Dynadot Inc on April 23, 2026, and resolves to IP address 188.114.97.3. It uses a Let's Encrypt SSL certificate (E8), which provides encryption but does not guarantee legitimacy. The domain appears on 1 security blocklist but is notably absent from Google Safe Browsing, meaning it may evade some automated protections. Its creation date in April 2026 confirms it is a very recent threat, likely set up specifically for this campaign.

As of the latest check, the domain remains active and is not yet suspended. PhishDestroy recommends users and organizations block access to guardian.security-bot.cc at the network level and report it to Cloudflare and relevant authorities. The primary risk is credential theft through the Cloudflare-branded phishing page. Users who have interacted with the site should change any credentials entered and monitor accounts for suspicious activity. Vigilance with URL verification and security tools remains the best defense against such evolving threats.