get-you-free-blue-tick-verify-badge[.]surge[.]sh

This domain is flagged as a high-risk credential phishing threat targeting users seeking Meta verification badges. Analysis indicates the page, titled 'Meta Verified — Free Badge,' is designed to harvest login credentials by impersonating an official verification process. The threat is classified as active, with infrastructure analysis revealing a direct risk to users who may be deceived into submitting sensitive account details. Infrastructure analysis reveals the domain get-you-free-blue-tick-verify-badge.surge.sh is hosted on Surge.sh, a platform often exploited for rapid phishing deployment. It resolves to the IP address 159.203.50.177, located in Canada under AS14061 (DigitalOcean, LLC). The SSL certificate is issued by Sectigo Limited, specifically the Sectigo Public Server Authentication CA DV R36, which provides minimal validation. Detection metrics indicate 18 out of 95 security vendors on VirusTotal have flagged this domain, while one additional blocklist (PhishDestroy) has also identified it as malicious. No creation date is publicly available, but the domain remains operational and unmitigated at the time of analysis. Mitigation against this credential phishing threat requires immediate action from both users and network administrators. Users should be educated to recognize the hallmarks of phishing pages, such as unsolicited verification prompts, misspelled domains, and lack of official branding consistency. Network-level protections should include blocking the domain and its resolving IP (159.203.50.177) at firewalls and DNS filters. Organizations are advised to monitor for credential reuse attempts, as harvested data may be leveraged for account takeovers or further social engineering attacks. Given the domain's persistence, continuous threat intelligence monitoring is recommended to track any shifts in infrastructure or new variants.