ridgecast[.]net

ridgecast.net was observed hosting a credential‑harvesting page titled “Security Check — Ridgecast”. The site returns an HTTP 302 redirect and presents a login‑style interface that mimics a legitimate service, indicating a targeted phishing effort. The domain was registered on 24 April 2026 and is currently listed as active.

Technical infrastructure shows the domain resolves to IP 205.185.118.213, a host located in the United States and attributed to the FranTech Solutions network. DNS resolution is provided by authoritative nameservers ns1.ridgecast.net and ns2.ridgecast.net, both under the same domain. The TLS certificate is issued by Let’s Encrypt (E8), confirming the use of a free, automated certificate.

Reputation data is uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist, where it is flagged by PhishDestroy. AlienVault OTX contains one pulse referencing the domain, further corroborating malicious use. No detections are present on VirusTotal at the time of analysis, but the lack of alerts does not constitute a safety indication.

Defenders should block traffic to 205.185.118.213 and to ridgecast.net at the network perimeter, and enforce URL filtering for any “security‑check” paths that reference the Ridgecast brand. Email security gateways should be configured to quarantine messages containing links to this domain, and incident response teams should monitor for credential submissions that may be exfiltrated through the site. Continuous re‑evaluation is advised as additional intelligence may emerge.