tslglobaltrading[.]com

This domain, tslglobaltrading.com, is flagged as an active phishing site targeting users of contract-for-difference (CFD) trading platforms. Analysis indicates the site presents itself as a trading service for stocks, gold, oil, and indices, as evidenced by the page title 'Remedy | CFD Trading — Trading on Stocks, Gold, Oil, Indices.' The domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to IP address 198.251.81.49, hosted by FranTech Solutions in the United States, and utilizes nameservers ns1.codehubhosting.com and ns2.codehubhosting.com. The domain is currently active, returning an HTTP 200 status code, and employs a Let's Encrypt SSL certificate (E7). It is detected on one security blocklist and was identified in a single threat intelligence pulse on AlienVault OTX. Four of ninety-one security vendors on VirusTotal flag the domain as malicious, though the specific nature of the detections remains unverified. The site's trust score is 0/100, reinforcing its high-risk classification. MX records indicate mail.tslglobaltrading.com as the designated mail server, which may facilitate further phishing or credential-harvesting campaigns. Defenders should treat this domain as a confirmed phishing threat. Network-level blocking is recommended, particularly for organizations in financial services or sectors where CFD trading scams are prevalent. Further investigation into associated infrastructure, such as the hosting provider and nameservers, may reveal additional linked domains. The exact phishing kit or payload remains unanalyzed, and no brand impersonation beyond the generic CFD trading theme has been confirmed.