apply-blue-mark-now[.]surge[.]sh

The domain apply-blue-mark-now.surge.sh is currently active and has been identified as a generic phishing infrastructure. It resolves to the IPv4 address 159.203.50.177, which is the sole host observed for this indicator. Registration details show that the domain was provisioned through the Surge.sh service, and its authoritative DNS records are unavailable (NS_NOT_FOUND).

The domain appears on two reputable phishing blocklists, specifically PhishDestroy and OpenPhish, confirming that it is being actively monitored by threat intelligence feeds. VirusTotal analysis reports that 14 of 91 security vendors have flagged the domain, indicating a moderate consensus among scanning engines that the site is malicious. No additional evidence such as SSL certificate details, HTTP response codes, page titles, or brand targeting is presently available, leaving the exact content and lure tactics of the site unverified.

Defenders should block traffic to the resolved IP address 159.203.50.177 and add the domain to local DNS filtering rules. Continuous monitoring of the domain’s DNS status and any future VirusTotal scans is recommended, as changes in detection counts could signal alterations to the payload or hosting configuration. Organizations employing outbound web filtering should ensure that both PhishDestroy and OpenPhish feeds are enabled to capture this indicator automatically.