financial-lpl[.]com

financial-lpl.com was observed resolving to 72.60.16.189, an address allocated to AS47583 Hostinger International Limited in Lithuania. The domain was registered on October 11, 2025 through Hostinger Operations UAB and is served by the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. No TLS certificate was presented, indicating the site was served over plain HTTP. The HTTP response returned the page title “LPL Financial Services”, which does not match the advertised brand “ankr” listed in the intelligence, confirming a brand‑impersonation profile.

Reputation services rated the host poorly; Gridinsoft assigned a trust score of 0 out of 100. VirusTotal recorded three positive detections among ninety‑five scanners, and the domain appears on a single security blocklist. The PhishDestroy feed has already taken the site offline, and current network probes indicate the host is no longer reachable. The evidence points to a short‑lived infrastructure typical of opportunistic impersonation campaigns, leveraging a free hosting provider and parking nameservers to reduce cost and increase turnover.

Uncertainty remains regarding the specific phishing kit or credential‑harvesting page because the site content has not been captured. Defenders should continue to block the domain and its associated IP address, monitor for future registrations of similar patterns, and consider adding the ASN to outbound traffic filters. Ongoing observation of Hostinger‑based registrants is recommended, as the provider’s open registration model frequently hosts transient malicious sites.