ict-liquidity[.]live

The domain ict-liquidity.live was registered on 19 June 2026 through Eranet International Limited. The zone is served by Cloudflare nameservers bingo.ns.cloudflare.com and newt.ns.cloudflare.com, indicating the use of Cloudflare's DNS and CDN services. The domain resolves to the IPv4 address 172.67.160.212, which belongs to AS13335 Cloudflare, Inc., a U.S.-based infrastructure provider. The short lifespan and recent registration suggest a purpose‑built operation rather than legacy legitimate activity. Network analysis shows the site delivers content over HTTPS using a certificate issued by Google Trust Services under the WE1 designation, and the TLS configuration enforces HTTP Strict Transport Security (HSTS). Cloudflare Browser Insights and HTTP/3 are enabled, confirming that the service is leveraging Cloudflare's performance and security features. The HTTP response code is 200, indicating the front‑end is actively serving the fraudulent page. Threat intelligence flags the site as a generic phishing host. VirusTotal reports eight out of ninety‑five scanning engines flagging the domain as malicious, and Gridinsoft assigns a trust score of zero out of one hundred. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. The page title “ICT Liquidity | Official Platform for AI Assisted Trading” is designed to imitate a financial service, aiming to lure victims into credential harvesting. Defenders should add ict-liquidity.live to network and endpoint deny lists, and ensure DNS filtering solutions block resolution of the domain. Continuous monitoring of Cloudflare‑associated IP ranges for anomalous traffic patterns is advised, as the infrastructure can be repurposed for other malicious campaigns. Security teams should also educate users about unsolicited requests for login information related to AI‑assisted trading platforms, emphasizing verification of legitimate URLs before credential submission.