lombard-finance[.]li

Analysis as of July 23, 2026 shows that the domain lombard-finance.li remains active and is being used for a generic phishing campaign. The site returns an HTTP 301 redirect and serves a TLS certificate issued by Let’s Encrypt (R13), indicating that encrypted connections are deliberately presented to victims. HTTP response headers include HSTS, reinforcing the expectation of secure transport. Front‑end assets reference jQuery, confirming the presence of a common JavaScript library, but no further client‑side behavior can be confirmed without content inspection. DNS resolution points to the IP address 54.177.117.207, which belongs to Amazon.com, Inc. (AS16509) and is hosted in the United States.

The domain is delegated to the nameservers geo.dyna-ns.net and geo2.dyna-ns.net, and its MX record is configured to webhost.dynadot.com, a typical Dynadot mail endpoint. Security telemetry indicates that 11 of 95 VirusTotal scanners have flagged the domain, and it appears in a single external blocklist. PhishDestroy has already blocked the domain, and Gridinsoft assigns it a trust score of 0 out of 100, reflecting a high confidence of malicious intent. AlienVault OTX lists the domain in one threat pulse, providing additional corroboration of its abusive use.

The only visible page element is the title “COMPASS,” which offers no further insight into the phishing lure or targeted brand. Because the underlying page content has not been publicly disclosed, the precise credential‑capture technique and targeted victims remain uncertain. Defenders should block the domain and its associated IP at perimeter and DNS layers, monitor for any additional domains resolving to the same Amazon‑hosted IP range, and consider adding the IP to reputation‑based denial lists. Continuous observation of DNS changes, MX re‑configurations, and any new SSL certificate issuance is recommended to detect rapid infrastructure shifts that are common in phishing operations.