# PhishDestroy domain threat record: go-for-free-verify-badge-here.surge.sh Content language: English Canonical HTML report: https://phishdestroy.io/domain/go-for-free-verify-badge-here.surge.sh/ Machine-readable companion: https://phishdestroy.io/domain/go-for-free-verify-badge-here.surge.sh/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-02 13:26:34 UTC - Last availability or vendor check: 2026-10-21 01:12:45 UTC - Stored record updated: 2026-10-22 14:22:29 UTC - VirusTotal detections in the stored snapshot: 14/90 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: facebook ## Stored infrastructure - Observed IP address: 159.203.50.177 - Registrar in stored WHOIS data: Surge.sh - Last stored HTTP status: 451 - Registration date (registry RDAP, surge.sh): 2014-07-25 23:10:53 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0624b-721c-76ef-b09b-4d2455565a40/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/go-for-free-verify-badge-here.surge.sh - Certificate Transparency search: https://crt.sh/?q=%25.go-for-free-verify-badge-here.surge.sh - Web Archive lookup: https://web.archive.org/web/*/https://go-for-free-verify-badge-here.surge.sh/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview go-for-free-verify-badge-here.surge.sh is an impersonation phishing page that poses as Facebook. Its subdomain promises a free verification badge, a lure aimed at page owners, creators and admins who want the blue check. PhishDestroy first saw it on 2026-09-02. The site has been offline since 2026-09-08, with its content blocked by the hosting provider, and it was still dead at the last check on 2026-10-19. How the scam works Fake badge offers usually arrive through messages or comments claiming the target qualifies for free verification. The link leads to a form styled like Facebook that asks for the account login and often the two-factor code, which hands the attacker full control of the profile and any pages or ad accounts tied to it. Hijacked accounts are then used to run scams, spread the same lure to new victims or extract payment from the owner. The page title currently reads "Unavailable", while we classified the site as a Facebook impersonation page. Evidence On 2026-09-04, 14 of 90 VirusTotal engines flagged the address, including BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, Emsisoft, Gridinsoft, alphaMountain.ai and Chong Lua Dao. That is a moderate count, but the vendors are independent of one another and agree on the verdict. urlscan.io rated the page malicious and recognized Facebook branding on it. PhishDestroy lists it on its own blocklist. Infrastructure The page sat on Surge.sh, a free static-site publishing service, so the operator only had to pick a subdomain name rather than register a domain. It resolved to DigitalOcean, LLC infrastructure in Canada and carried a domain-validated Sectigo certificate inherited from the platform. Throwaway subdomains like this are cheap to create and abandon, which matches the short window between first sighting and the takedown on 2026-09-08. What to do If you entered your Facebook login here, change the password immediately, enable an authenticator app for two-factor authentication, and log out all other sessions from the account's security settings. Review page roles, ad accounts and linked email addresses for changes you did not make, and report the compromise through Facebook's hacked-account flow. Facebook does not hand out badges through external links, so treat any such offer as a scam. Defenders should block the subdomain and watch for similar badge-themed hosts on free publishing platforms. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0624b-721c-76ef-b09b-4d2455565a40/ VirusTotal report: https://www.virustotal.com/gui/domain/go-for-free-verify-badge-here.surge.sh Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=go-for-free-verify-badge-here.surge.sh Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:23:56 UTC ## Stored page captures - Primary capture: https://i.ibb.co/B5k72kQp/ad9b810d756b.png Captured: 2026-09-02 13:26:34 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0624b-721c-76ef-b09b-4d2455565a40.png Captured: 2026-09-02 13:26:34 UTC Source report: https://urlscan.io/result/01a0624b-721c-76ef-b09b-4d2455565a40/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ff13f4aa-7671-4c30-b475-c45bd4a64788.png Captured: 2026-09-02 13:50:27 UTC Source report: https://radar.cloudflare.com/scan/ff13f4aa-7671-4c30-b475-c45bd4a64788 SHA-256: 0901d878a2d0df1f2b78ef1f0bcd8886681062951c55522c911a3e4f550d3f17 - URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a06238-6142-728a-a725-01ca170fe1d7.png Captured: 2026-09-02 13:04:27 UTC Source report: https://urlscan.io/result/01a06238-6142-728a-a725-01ca170fe1d7/ SHA-256: 1cc71dddef992bc4e874663244712fe7de74c14933ef946ba9fdfdfb63c1be8a - URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a062bc-e0a1-7358-b416-01793b461ee7.png Captured: 2026-09-02 15:29:06 UTC Source report: https://urlscan.io/result/01a062bc-e0a1-7358-b416-01793b461ee7/ SHA-256: c403ee809814a20b0ac96fef7efab6487af3ba796e8e533b411d489c1ddb1c46 - URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a06304-5d06-774b-83c7-89cc1da8dfe9.png Captured: 2026-09-02 16:47:12 UTC Source report: https://urlscan.io/result/01a06304-5d06-774b-83c7-89cc1da8dfe9/ SHA-256: c403ee809814a20b0ac96fef7efab6487af3ba796e8e533b411d489c1ddb1c46 - URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a06fa7-d980-71fd-b3cd-11d9ae51459e.png Captured: 2026-09-05 03:41:11 UTC Source report: https://urlscan.io/result/01a06fa7-d980-71fd-b3cd-11d9ae51459e/ SHA-256: c403ee809814a20b0ac96fef7efab6487af3ba796e8e533b411d489c1ddb1c46 - URLScan · 2026-09-08: https://screenshots.phishdestroy.io/us/01a0826d-e5ab-7374-8336-64d33740542d.png Captured: 2026-09-08 19:10:41 UTC Source report: https://urlscan.io/result/01a0826d-e5ab-7374-8336-64d33740542d/ SHA-256: c403ee809814a20b0ac96fef7efab6487af3ba796e8e533b411d489c1ddb1c46 - URLScan · 2026-10-01: https://screenshots.phishdestroy.io/us/01a0f71e-ba7f-74bb-a530-fbb439c5913a.png Captured: 2026-10-01 10:59:47 UTC Source report: https://urlscan.io/result/01a0f71e-ba7f-74bb-a530-fbb439c5913a/ SHA-256: 774e365fa98c9b403635404d16bbd3a0a695c975092f0f469a8b5549c3840461 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:54:52Z", "uuid": "01a0624b-721c-76ef-b09b-4d2455565a40", "scanned_at": "2026-09-02T13:25:16Z", "final_url": "https://go-for-free-verify-badge-here.surge.sh/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://go-for-free-verify-badge-here.surge.sh/", "from": "http://go-for-free-verify-badge-here.surge.sh/", "status": 307 } ], "ip": "46.101.67.123", "domains": [ "link-of-video-step3.wasmer.app", "cdnjs.cloudflare.com", "logo-ver.vercel.app", "resource2.heygen.ai" ], "ips": [ "5.78.26.104", "216.198.79.195", "104.17.25.14", "46.101.67.123" ], "asns": [ "212317", "16509", "13335", "14061" ], "countries": [ "US", "GB" ], "doc_hash": "3cb28ba98eb7cb2b1b699cb3207956d3377b8907adbaa07e08c48c3cef4c2f70", "tls": { "san": [ "*.surge.sh", "surge.sh" ], "cipher": "AES_256_GCM", "issuer": "Sectigo Public Server Authentication CA DV R36", "subject": "*.surge.sh", "protocol": "TLS 1.3", "valid_to": "2026-12-16T23:59:59Z", "valid_from": "2026-06-01T00:00:00Z" }, "domain_age_days": 0, "apex_age_days": 4212, "tls_age_days": 93, "tls_valid_days": 198, "requests": 9, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "facebook" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Facebook" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "Surge", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:35:17Z", "uuid": "ff13f4aa-7671-4c30-b475-c45bd4a64788", "scanned_at": "2026-09-02T13:50:27Z", "final_url": "https://go-for-free-verify-badge-here.surge.sh/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://go-for-free-verify-badge-here.surge.sh/", "status": 307 }, { "url": "https://go-for-free-verify-badge-here.surge.sh/", "status": 200 } ], "dom_hash": "1a97b39d4c29667ce5786f07726b792aabb8f3e23a328c7a98a706d6dc29cbd0", "doc_hash": "3cb28ba98eb7cb2b1b699cb3207956d3377b8907adbaa07e08c48c3cef4c2f70", "phishing_v2": [ "phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "go-for-free-verify-badge-here.surge.sh", "type": "A", "value": "159.203.50.177" } ], "dnssec_valid": false, "ip": "159.203.50.177", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Porkbun LLC", "created": "2014-07-25T23:10:53Z", "updated": "2026-08-11T20:27:40Z", "expires": "2027-07-25T23:10:53Z", "nameservers": [ "ns1.surge.world", "ns2.surge.world", "ns3.surge.world", "ns4.surge.world" ] } } } ```