apply-tick-easy-getfree[.]surge[.]sh

This domain, apply-tick-easy-getfree.surge.sh, is flagged as a high-risk fake login portal designed to harvest user credentials. Analysis indicates the site mimics legitimate authentication pages, tricking visitors into entering sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure supports rapid credential exfiltration, with backend systems likely configured to relay stolen data to attacker-controlled servers for immediate exploitation or resale on underground markets. The threat extends beyond individual compromise, as stolen credentials may enable further attacks, including account takeovers, financial fraud, or lateral movement within corporate networks. Infrastructure analysis reveals concrete indicators of malicious activity. The domain resolves to IP address 188.166.132.94, hosted on AS14061 (DigitalOcean, LLC) in Canada, and is registered through Surge.sh, a platform often abused for rapid deployment of phishing pages. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while one security blocklist has already listed it. The SSL certificate, issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R3, provides a veneer of legitimacy but does not mitigate the underlying threat. No creation date is publicly available, but the domain remains active and unblocked by most security controls, increasing its potential reach. Users who have visited apply-tick-easy-getfree.surge.sh or entered credentials on the site should take immediate action. First, revoke any sessions associated with the compromised account and reset passwords using a secure, unrelated device. Enable multi-factor authentication if not already active, and monitor accounts for unauthorized activity, including login attempts, password changes, or unfamiliar transactions. If corporate credentials were exposed, notify internal security teams to assess potential lateral movement risks. Additionally, scan the device used to access the site for malware, as phishing pages may deploy secondary payloads. Finally, report the domain to relevant security teams or threat intelligence platforms to aid in broader mitigation efforts.