rovemarktberg[.]live

Analysis of rovemarktberg.live shows a newly registered domain (creation date May 15 2026) that hosts a page titled “Rove Marktberg | Official Platform for AI Assisted Trading”. The site resolves to IP 188.114.97.3, served through Cloudflare’s network (nameservers hal.ns.cloudflare.com and jocelyn.ns.cloudflare.com, Cloudflare location CA). TLS termination is provided by a Let’s Encrypt certificate (issuer E7), and the HTTP response returns status 200, indicating a fully operational web service.

Infrastructure signals point to malicious intent. The domain appears on a known security blocklist and is specifically listed by PhishDestroy as a phishing vector. Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating, and VirusTotal records three out of ninety‑five scanners flagging the site as malicious. AlienVault OTX identifies the domain in one threat‑intel pulse, reinforcing the suspicion that the site is being used to harvest credentials under the guise of AI‑driven trading services.

While the technical footprint confirms a high‑risk profile, certain details remain unclear. The exact phishing kit or credential‑harvesting mechanism is not disclosed in public evidence, and there is no publicly available information on the backend infrastructure beyond the Cloudflare edge. No corroborating reports link the site to specific victim campaigns, leaving the scale of exploitation open to investigation.

Defenders should block network access to rovemarktberg.live at perimeter and DNS layers, and add the associated IP 188.114.97.3 to deny lists. Monitoring for outbound connections to Cloudflare edge nodes from compromised hosts is advisable. Incident responders should inspect email artifacts for references to “Rove Marktberg” or AI‑assisted trading narratives, and enforce multi‑factor authentication for accounts that may be targeted by this phishing front.