tradecontractor[.]pages[.]dev

PhishDestroy identifies TradeContractor.pages.dev as an active fake construction contractor phishing domain under investigation for generic credential harvesting. This deceptive site masquerades as a legitimate contractor portal to trick victims into entering login credentials, exposing them to direct financial and identity theft risks.

This domain was flagged with a risk level marked as under investigation and is currently active. TradeContractor.pages.dev resolves to IP address 188.114.97.3 and is registered through Cloudflare, Inc. The domain holds a valid Let's Encrypt SSL certificate, which may lend false credibility to unsuspecting users. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating that traditional antivirus solutions have not yet flagged this threat. There are no current entries in major public blocklists such as Google Safe Browsing, PhishTank, or OpenPhish, and the domain does not appear on any known domain reputation or trust score platforms. The absence of detections and blocklist presence suggests this is a relatively new or stealthily operated campaign.

Mitigation against this type of fake contractor phishing site requires both proactive and reactive measures. Users should avoid clicking on unsolicited links claiming to lead to contractor portals, especially those delivered via email or social media. Always verify the sender’s domain and use official company websites by manually entering URLs or using trusted bookmarks. Organizations should implement email filtering rules to detect impersonation attempts and consider blocking newly registered domains with low reputation scores. If exposure occurs, immediately reset account credentials, enable multi-factor authentication, and monitor for signs of credential misuse or financial fraud. Report suspicious domains to cybersecurity authorities such as CISA or your national cybercrime unit to aid in rapid takedown efforts.