loisconstruction[.]com

loisconstruction.com was flagged on July 12, 2026 as a high‑risk generic phishing site. The domain is currently active and resolves to a single IPv4 address. Automated analysis and multiple security feeds have assigned it a high confidence malicious rating, prompting immediate defensive attention.

The domain was registered on January 24, 2025 through Dynadot LLC and is hosted on an IP address 198.12.80.250 belonging to AS36352 (HostPapa) in the United States. The TLS certificate presented is issued by GoDaddy.com under the GoDaddy TLS Intermediate CA DV – R1v1 chain, indicating a publicly trusted certificate. PhishDestroy has listed the domain on its blocklist, and the domain appears on one additional security blocklist. VirusTotal reports 11 of 95 scanned security vendors flagging the host as malicious, and Gridinsoft assigns a trust score of 0 out of 100.

A HTTP GET request returns status code 200 and the page title is “Civil Construction Services | LOIS Construction”. The site runs PHP on an Apache HTTP Server and loads client‑side libraries including jQuery, jQuery UI, Google Tag Manager, Google Analytics, and Contentsquare. These components are typical of legitimate web services but do not mitigate the phishing classification. The low trust score and vendor detections reinforce the malicious assessment.

Current gaps include the absence of publicly disclosed phishing payloads or credential‑capture pages, as the content has not been manually reviewed. Defenders should block the domain and its associated IP at network perimeters, enforce DNS sinkholing, and monitor for any outbound connections to the host. Continuous re‑scanning is recommended to capture potential changes in the site’s behavior.