checker[.]lombardfiance[.]xyz

Analysis of checker.lombardfiance.xyz shows a clear malicious profile consistent with generic phishing infrastructure. The domain resolves to IP 104.21.1.24, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Registration details list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar, a service frequently associated with disposable or low‑trust domains. The site was created on September 16 2025 and is currently reported as taken offline, indicating that the malicious content has been removed or the host has been shut down.

A single security blocklist, identified by PhishDestroy, already flags the domain, and VirusTotal records show that 7 of 95 scanning engines have classified the host as malicious, reinforcing the phishing assessment. The page title returned by HTTP requests is "Just a moment...", a generic placeholder that provides no legitimate user‑facing content. No SSL certificate is presented, meaning the site operates over unencrypted HTTP, a common trait of hastily deployed phishing pages. The Gridinsoft trust score of 0 / 100 further confirms the extreme risk associated with the domain.

Nameserver resolution points to noel.ns.cloudflare.com and sloan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service, which can obscure the true origin of the server. While the available data confirms phishing intent, the specific victim‑targeted brand, credential‑stealing mechanism, or payload details remain unknown because the site content has not been captured. Defenders should block the domain and its resolving IP address at perimeter firewalls and proxy filters, add the domain to internal threat‑intel feeds, and monitor the IP range for any re‑use of the same infrastructure. Continuous watch for re‑registration of the domain or similar Cloudflare‑hosted subdomains is advised, as actors often recycle short‑lived domains for new campaigns.