request-submit-here-form[.]surge[.]sh

This domain, request-submit-here-form.surge.sh, is flagged as an active credential harvesting phishing site as of July 23, 2026. Infrastructure analysis reveals it is hosted on Surge.sh, a free static web publishing service often exploited for phishing due to its low barrier to deployment and lack of upfront registration requirements. The domain resolves to IP address 138.68.112.220 but lacks assigned nameservers, a common characteristic of ephemeral phishing pages. Detection data from VirusTotal indicates that 12 of 95 security vendors classify this domain as malicious, providing technical confirmation of its threat status.

The domain appears on one security blocklist and is actively blocked by PhishDestroy, further corroborating its classification as a high-risk phishing resource. No specific brand target, phishing kit, or page title is currently available for analysis, limiting attribution to a particular campaign or impersonated entity. The absence of nameservers and reliance on a free hosting provider suggest the domain is part of a short-lived operation designed to evade detection and takedown.

Defenders should treat this domain as a confirmed phishing endpoint and prioritize blocking at the DNS and network layers. Monitoring for related subdomains or IP-based indicators (138.68.112.220) may help identify additional malicious infrastructure. Given the domain's active status and detection by multiple security vendors, immediate action is recommended to prevent credential theft or further compromise.