prickly-ear[.]surge[.]sh

Analysis of the domain prickly-ear.surge.sh indicates it was actively impersonating Rackspace, a hosted email and cloud services provider. The page title, 'Rackspace Webmail: Hosted Email for Business,' directly matches Rackspace's branding, suggesting an attempt to deceive users into entering credentials or sensitive information. The domain was registered through Surge.sh, a static web publishing service often exploited for low-cost phishing deployments. Infrastructure analysis reveals the domain resolved to the IP address 138.68.112.220, hosted under AS14061 (DigitalOcean, LLC) in Germany. The SSL certificate was issued by Sectigo Limited, a common certificate authority, providing no inherent indication of malicious intent but offering encrypted connections typical of phishing sites.

As of the report date, the domain appears on one security blocklist, specifically PhishDestroy, and was flagged by 14 of 95 security vendors on VirusTotal, confirming detection by multiple threat intelligence sources. The HTTP status returned a 404 error, indicating the page was taken offline or removed, though the underlying infrastructure may remain accessible. Nameservers ns1.surge.sh and ns2.surge.sh are consistent with Surge.sh's hosting environment, which lacks built-in abuse mitigation, allowing rapid deployment and takedown of malicious content. Defenders should treat this domain as part of a broader Rackspace-themed credential harvesting campaign.

While the page is no longer accessible, the IP and hosting provider may still pose risks if reused for future phishing operations. Organizations should monitor for similar Surge.sh-hosted domains mimicking Rackspace or other enterprise email providers, particularly those using static hosting services with minimal registration barriers. Blocking the IP 138.68.112.220 and the Surge.sh nameservers at the network level may mitigate residual risk.