contractor-proposals[.]com

contractor-proposals.com was registered on May 11, 2026 through Amazon Registrar, Inc. The domain resolves to the IPv4 address 199.36.158.100, which is hosted by Google LLC in the United States. Authoritative name servers are ns-1203.awsdns-22.org, ns-1956.awsdns-52.co.uk, ns-464.awsdns-58.com, and a fourth entry truncated in the source data. The site presents an HTTP 200 response and serves a TLS certificate issued by Google Trust Services under the WR3 profile, indicating a valid, publicly trusted certificate chain. The public-facing page is titled “Atlas10: Pavement Condition Intelligence”, a content theme unrelated to any legitimate contractor proposal workflow. This mismatch is a common indicator of a credential‑harvesting front‑end that lures users with a deceptive brand or service label. The domain has been referenced in a single AlienVault OTX pulse, suggesting that at least one threat‑intelligence source has previously linked it to malicious activity. VirusTotal analysis shows that one out of ninety‑five scanned security vendors flagged the domain, reflecting a low but non‑zero detection rate. Independent blocklist providers—including PhishDestroy, MetaMask, and SEAL—have added the domain to their watchlists, and the Gridinsoft trust score is reported as 0 out of 100. The combination of high‑severity risk rating, active status, and presence on multiple blocklists aligns with the classification of a high‑risk phishing infrastructure. Defenders should block network resolution to 199.36.158.100 and enforce URL filtering for the exact host name contractor‑proposals.com. Email security gateways ought to inspect inbound messages for references to contractor proposals or related terminology and apply phishing‑prevention rules. Continuous monitoring of the associated name servers and the Google‑owned IP range is advised, as the infrastructure may be leveraged for additional phishing sites or payload delivery in the near term.