en-us-ledge-strt[.]pages[.]dev

Domain en-us-ledge-strt.pages.dev has been tagged by PhishDestroy as an active credential-harvesting probe while the investigation remains in the under-investigation stage. This determination is provisional and subject to change as additional telemetry is collected.

This domain is currently resolving to IP address 172.66.44.124 and is served via Cloudflare, Inc. registration infrastructure. The SSL certificate protecting the site is issued by Google Trust Services, a detail that may lend superficial legitimacy to unsuspecting users. As of the latest VirusTotal snapshot, the domain remains undetected by any of the 95 engines, resulting in a 6/95 detection ratio and no blocks on public blocklists. The absence of detections suggests either novel deployment or evasive hosting techniques rather than benign status.

Mitigation should focus on preemptive blocking at both DNS and network layers. Enterprises are advised to add 172.66.44.124 and the fully qualified domain en-us-ledge-strt.pages.dev to internal blocklists and to configure endpoint controls to flag any HTTP POST requests to the domain or its IP. User awareness training should emphasize verifying the destination domain prior to entering credentials, especially when links arrive via unsolicited messages. Continuous monitoring of this seed ID 1ab04e will drive updates to detection logic as new IOCs emerge.