nordmarkgpt[.]live

The domain nordmarkgpt.live has been identified as a phishing infrastructure impersonating an AI-assisted trading platform. Analysis indicates this domain poses a credential harvesting threat, specifically targeting users seeking automated financial tools by mimicking legitimate AI-driven trading services. The page title, 'Nordmark GPT | Official Platform for AI Assisted Trading,' suggests an attempt to deceive users into believing they are accessing an authorized service, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered on June 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been flagged in prior malicious campaigns. Detection metrics show that 6 of 95 security vendors on VirusTotal have classified this domain as malicious, and it appears on one security blocklist. The SSL certificate, issued by Google Trust Services, provides a superficial layer of legitimacy but does not mitigate the underlying phishing risk. The domain's creation date, combined with its rapid detection by security systems, indicates a short-lived, high-impact campaign designed for quick exploitation. As of the latest assessment, nordmarkgpt.live has been taken offline, reducing immediate exposure. However, users who may have interacted with the domain should assume credential compromise and take corrective action. Recommended steps include resetting passwords for any financial or trading accounts, enabling multi-factor authentication where available, and monitoring for unauthorized transactions. Organizations are advised to update their web filtering rules to block this domain and its associated IP address, while end-users should exercise caution when engaging with unsolicited AI or trading-related offers, particularly those delivered via email or social media.