# PhishDestroy domain threat record: msgg-serves.surge.sh Content language: English Canonical HTML report: https://phishdestroy.io/domain/msgg-serves.surge.sh/ Machine-readable companion: https://phishdestroy.io/domain/msgg-serves.surge.sh/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-04 15:42:06 UTC - Last availability or vendor check: 2026-10-22 10:10:55 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 16/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 159.203.50.177 - Registrar in stored WHOIS data: Surge.sh - Last stored HTTP status: 200 - Registration date (registry RDAP, surge.sh): 2014-07-25 23:10:53 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a06d14-8405-74ed-b9bd-579ccf3fb85e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/msgg-serves.surge.sh - Certificate Transparency search: https://crt.sh/?q=%25.msgg-serves.surge.sh - Web Archive lookup: https://web.archive.org/web/*/https://msgg-serves.surge.sh/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview msgg-serves.surge.sh is a page on a free static-hosting subdomain that greets visitors with the French prompt "Identifiez-vous", meaning "identify yourself" or "sign in". No brand is named, but the wording points at French-speaking users being asked to log in. PhishDestroy first saw the page on 2026-09-04, and it remains on our blocklist. As of 2026-10-19 the site was still online and serving content. How the scam works A bare login prompt on a throwaway subdomain, with no recognisable service behind it, is a common setup for collecting sign-in details. Visitors arrive from a link in an email or message and are asked to type a username, email address or password into a form controlled by whoever deployed the page. Anything entered there should be treated as exposed. The page does not show which account or brand it targets, so we have not assigned a specific scheme. Evidence On 2026-09-18, 16 of 89 VirusTotal engines flagged the address as malicious or suspicious. The vendors include BitDefender, ESET, Fortinet, G-Data, Emsisoft, CyRadar, alphaMountain.ai and AILabs (MONITORAPP). That is a meaningful minority of independent engines, enough to show this is not a single vendor's false alarm. PhishDestroy is the only blocklist in our listing that carries it. Infrastructure The page sits on Surge.sh, a free platform where anyone can publish a static site under their own subdomain in minutes. Nothing was registered separately, which makes this kind of page cheap to create and easy to replace. The server answers from an address in Canada. The Sectigo domain-validated certificate gives the page a padlock, but that only means the connection is encrypted and says nothing about who runs it. What to do If you typed any username, email or password into this page, change that password immediately, starting with the account the credentials belong to and any other service where you reused it. Turn on two-factor authentication and review recent sign-ins and forwarding rules for activity you do not recognise. Treat follow-up messages asking you to "confirm" your identity with suspicion. Defenders should block the subdomain at the web proxy and DNS layer and search mail logs for links to it. Report it to Surge.sh so the deployment can be removed. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a06d14-8405-74ed-b9bd-579ccf3fb85e/ VirusTotal report: https://www.virustotal.com/gui/domain/msgg-serves.surge.sh Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=msgg-serves.surge.sh Archived copy: https://web.archive.org/web/20260904155957/https://msgg-serves.surge.sh/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:48:32 UTC ## Stored page captures - Primary capture: https://i.ibb.co/35MxRtLh/ec99bc8500cd.png Captured: 2026-09-04 15:42:06 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a06d14-8405-74ed-b9bd-579ccf3fb85e.png Captured: 2026-09-04 15:42:06 UTC Source report: https://urlscan.io/result/01a06d14-8405-74ed-b9bd-579ccf3fb85e/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/82301761-9354-4cda-a6ca-c4c2b8fdbde1.png Captured: 2026-09-04 16:00:55 UTC Source report: https://radar.cloudflare.com/scan/82301761-9354-4cda-a6ca-c4c2b8fdbde1 SHA-256: 5b685b6fd0c356b8389e33596a40c60d2f63ca6aac5f9ec6250f109105361924 - URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06c83-a591-7308-af95-fdd3d357f497.png Captured: 2026-09-04 13:02:48 UTC Source report: https://urlscan.io/result/01a06c83-a591-7308-af95-fdd3d357f497/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06d0f-8161-73ef-976a-de9b8d7b5f09.png Captured: 2026-09-04 15:35:33 UTC Source report: https://urlscan.io/result/01a06d0f-8161-73ef-976a-de9b8d7b5f09/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06d85-e93d-7766-afb9-12a3fce59c5a.png Captured: 2026-09-04 17:44:57 UTC Source report: https://urlscan.io/result/01a06d85-e93d-7766-afb9-12a3fce59c5a/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a06fa7-dace-70dc-998b-612b62b78f8f.png Captured: 2026-09-05 03:41:12 UTC Source report: https://urlscan.io/result/01a06fa7-dace-70dc-998b-612b62b78f8f/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a07036-b0a8-74f6-9ed4-f87ac1fcfcdd.png Captured: 2026-09-05 06:17:15 UTC Source report: https://urlscan.io/result/01a07036-b0a8-74f6-9ed4-f87ac1fcfcdd/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-09-08: https://screenshots.phishdestroy.io/us/01a081da-7fe9-77e9-bef6-35a8808ae91d.png Captured: 2026-09-08 16:29:42 UTC Source report: https://urlscan.io/result/01a081da-7fe9-77e9-bef6-35a8808ae91d/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:52:02Z", "uuid": "01a06d14-8405-74ed-b9bd-579ccf3fb85e", "scanned_at": "2026-09-04T15:41:02Z", "final_url": "https://msgg-serves.surge.sh/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://msgg-serves.surge.sh/", "from": "http://msgg-serves.surge.sh/", "status": 307 } ], "ip": "159.203.50.177", "ips": [ "159.203.50.177" ], "asns": [ "14061" ], "countries": [ "CA" ], "doc_hash": "d52de7061d1938b86c5e1bd487206537a4d590fe6fec268835fe62bc94e41bfa", "script_hashes": [ "7f6323c5aa3c282b7ae14dd45ea39970eb92c76d20f9852007e8fcd18115e45b" ], "tls": { "san": [ "*.surge.sh", "surge.sh" ], "cipher": "AES_256_GCM", "issuer": "Sectigo Public Server Authentication CA DV R36", "subject": "*.surge.sh", "protocol": "TLS 1.3", "valid_to": "2026-12-16T23:59:59Z", "valid_from": "2026-06-01T00:00:00Z" }, "domain_age_days": 904, "apex_age_days": 4214, "tls_age_days": 95, "tls_valid_days": 198, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -56, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Surge", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:02:11Z", "uuid": "82301761-9354-4cda-a6ca-c4c2b8fdbde1", "scanned_at": "2026-09-04T16:00:55Z", "final_url": "https://msgg-serves.surge.sh/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://msgg-serves.surge.sh/", "status": 307 }, { "url": "https://msgg-serves.surge.sh/", "status": 200 } ], "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e", "doc_hash": "d52de7061d1938b86c5e1bd487206537a4d590fe6fec268835fe62bc94e41bfa", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "msgg-serves.surge.sh", "type": "A", "value": "159.203.50.177" } ], "dnssec_valid": false, "ip": "159.203.50.177", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Porkbun LLC", "created": "2014-07-25T23:10:53Z", "updated": "2026-08-11T20:27:40Z", "expires": "2027-07-25T23:10:53Z", "nameservers": [ "ns1.surge.world", "ns2.surge.world", "ns3.surge.world", "ns4.surge.world" ] } } } ```