grossmargin[.]live

Analysis of the domain grossmargin.live indicates it is actively hosting a fraudulent trading platform. Registered on May 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 172.67.153.89, which is geolocated to Cloudflare infrastructure in Canada. The site presents itself as an 'Official Platform for AI Assisted Trading,' as stated in its page title, aligning with the identified scam type of a fake exchange. Infrastructure review shows the domain uses Cloudflare nameservers (adi.ns.cloudflare.com and leland.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial E7), providing HTTPS encryption. While this configuration is common among legitimate services, it is also frequently exploited by threat actors to lend credibility to phishing sites. The domain is currently active, returning an HTTP 200 status, and has been flagged by at least one security blocklist. AlienVault OTX records the domain in a threat intelligence pulse, and three of 92 security vendors on VirusTotal have detected it as malicious. Defenders should treat grossmargin.live as high-risk. The domain's recent registration, use of Cloudflare for anonymization, and association with a fake trading scam suggest it is part of an ongoing phishing campaign. No legitimate financial service is known to operate under this domain. Network-level blocking and monitoring for connections to 172.67.153.89 are recommended. Further analysis of the site's content and backend infrastructure may reveal additional indicators of compromise, but as of this report, no specific phishing kit or brand impersonation beyond the stated 'AI Assisted Trading' claim has been confirmed.