permanent-verified-blue-tick[.]surge[.]sh

The domain permanent-verified-blue-tick.surge.sh is currently flagged as a high‑risk phishing site. Open‑source intelligence shows that the domain is hosted on the Surge.sh platform and resolves to the IPv4 address 159.203.159.100. No authoritative nameserver records are returned, indicating that standard DNS enumeration does not reveal the hosting provider’s internal naming scheme. The domain appears on two reputable phishing blocklists, specifically PhishDestroy and OpenPhish, both of which have classified it as active phishing infrastructure.

VirusTotal has recorded detections from 16 of 91 scanned security engines, reinforcing the suspicion that the site distributes malicious content or harvests credentials. The registration details list Surge.sh as the registrar, a service commonly used for short‑lived or rapidly deployed sites, which aligns with the observed pattern of transient phishing deployments. No additional metadata such as SSL certificate details, HTTP response codes, or page titles are available in the current dataset, leaving the exact content of the site unverified. Given the convergence of multiple independent indicators—blocklist inclusion, multi‑engine detections, and a dedicated IP address—the risk rating of high is justified.

Defenders should continue to block the domain at network perimeters, update intrusion‑detection signatures to include the resolved IP, and monitor any future DNS changes that could indicate a shift in hosting. Continuous re‑scanning on platforms like VirusTotal is recommended to capture any evolution of the payload. Until more detailed content analysis is performed, the domain should be treated as a confirmed phishing threat.