cairnmarktberg[.]live

The domain cairnmarktberg.live was registered on May 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted behind Cloudflare’s network (IP 172.67.179.17, located in Canada). The site serves a page titled “Cairn Marktberg | Official Platform for AI Assisted Trading” and presents a valid TLS certificate issued by Let’s Encrypt (E8). HTTP requests return a 200 status code, indicating the site is reachable and actively serving content.

Threat intelligence shows the domain appears in a single AlienVault OTX pulse and is listed on one security blocklist. Independent analysis by Gridinsoft assigned a trust score of 0 out of 100, and PhishDestroy has explicitly blocked the domain. VirusTotal reports that three of ninety‑five scanned security vendors flag the domain as malicious, reinforcing the suspicion that it is being used for phishing activities.

While the public facing page advertises an AI‑assisted trading platform, no additional artefacts such as malicious payloads, credential‑stealing forms, or known phishing kits have been publicly disclosed. This lack of deeper content evidence creates uncertainty about the exact lure or data collection mechanisms employed. The presence of a reputable certificate and Cloudflare protection may be used to increase perceived legitimacy and evade simple URL‑based detection.

Defenders should prioritize blocking cairnmarktberg.live at perimeter firewalls and DNS resolvers, as the domain is already identified by multiple threat feeds. Continuous monitoring of outbound connections to the associated IP address is advised, alongside updating endpoint detection rules to flag any attempts to load resources from the site. Organizations that handle financial credentials or AI‑related services should treat any inbound traffic from this domain as high‑risk and enforce multi‑factor authentication and strict email verification to mitigate potential credential harvesting.