contourvest[.]com

This domain, contourvest.com, poses as a legitimate Contract for Difference (CFD) trading platform offering investments in stocks, gold, oil, and indices. Analysis indicates it is a phishing site designed to harvest financial credentials, payment details, and personal identification information from victims under the pretense of trading services. The page title, 'ContourVest | CFD Trading — Trading on Stocks, Gold, Oil, Indices,' explicitly mimics the branding of established financial brokers to deceive users into entering sensitive data. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 12, 2026, through TuringSign Inc. d/b/a Cosmotown, an uncommon registrar for legitimate financial services. It resolves to the IP address 37.49.229.75 and is flagged by 5 out of 95 security vendors on VirusTotal, including detections for generic phishing. Additionally, contourvest.com appears on two security blocklists, including PhishDestroy and OISD, and has a Gridinsoft trust score of 1 out of 100. The site employs technologies such as Tailwind CSS, Alpine.js, and jQuery, which are frequently used in both legitimate and malicious web applications to create convincing interfaces. Users who visited contourvest.com or interacted with its content should take immediate remediation steps. Isolate any device used to access the domain and perform a full antivirus scan to detect potential malware or credential-stealing scripts. Reset passwords for financial accounts, banking portals, and email services accessed from the same device, prioritizing accounts with elevated privileges. Monitor financial statements for unauthorized transactions and report suspicious activity to relevant financial institutions. If personal or payment information was submitted, consider placing a fraud alert with credit bureaus and reviewing credit reports for signs of identity theft.