abjectvpm14zudp3ug1vdvhedtnl239kiyel1smarket[.]surge[.]sh

This domain, abjectvpm14zudp3ug1vdvhedtnl239kiyel1market.surge.sh, is identified as a high-risk brand impersonation threat targeting Yahoo. The domain impersonates Yahoo's official page, likely aiming to deceive users and harvest sensitive information such as login credentials or personal data.

Infrastructure analysis reveals that the domain is registered through Surge.sh and resolves to the IP address 138.197.235.123, located in the Netherlands (NL) and operated by AS14061 DigitalOcean, LLC. The SSL certificate is issued by Sectigo Limited / Sectigo RSA Domain Validation Secure Server CA. The domain was flagged by 17 out of 95 security vendors on VirusTotal, indicating a moderate level of consensus on its malicious nature. Google Safe Browsing also marks the domain as phishing, and it appears on 2 security blocklists, including PhishDestroy and PhishingDB.

Currently, the domain is offline, which may indicate that it has been taken down or is no longer active. Despite this, the domain's previous activity and the high number of security flags suggest that the threat remains significant. Users and organizations should remain vigilant and ensure that any links or pages claiming to be Yahoo are verified through official channels. Security teams are advised to monitor for any resurgence of the domain and to implement additional protective measures such as DNS filtering and user education.