refund-meta-ads[.]surge[.]sh

The domain refund-meta-ads.surge.sh is presently offline, returning an HTTP 404 status, yet its underlying infrastructure remains observable. DNS resolution points to the IP address 138.68.112.220, which belongs to DigitalOcean, LLC (AS14061) and is geolocated in Germany. The domain is served by the default Surge.sh name servers (ns1.surge.sh, ns2.surge.sh) and was registered through the Surge.sh platform, a service often used for rapid deployment of static web content.

The TLS handshake presents a Sectigo Limited issued Sectigo RSA Domain Validation Secure Server certificate, confirming that the domain is capable of serving encrypted traffic despite the current 404 response. The page title retrieved before the site went offline was "Meta Business Support," directly referencing Meta’s business services, and the listed scam type is Social Media Phishing that impersonates Facebook. Security telemetry shows the domain is listed on one known blocklist, specifically PhishDestroy, and VirusTotal reports 13 of 95 scanning engines flagging the host as malicious, indicating a moderate consensus among detection vendors.

While the site content is not presently reachable, the combination of a Facebook‑related title, a reputable hosting provider, a valid SSL certificate, and multiple vendor detections suggests the domain was used for brand impersonation. Defenders should continue to block the domain at network and endpoint layers, monitor the associated IP address for any reactivation, and consider adding similar Surge.sh subdomains to watchlists, especially those that reference Meta or Facebook. Ongoing observation of VirusTotal and other threat feeds is recommended to capture any resurgence of activity.