# PhishDestroy domain threat record: ragebait.surge.sh Content language: English Canonical HTML report: https://phishdestroy.io/domain/ragebait.surge.sh/ Machine-readable companion: https://phishdestroy.io/domain/ragebait.surge.sh/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-26 10:24:22 UTC - Last availability or vendor check: 2026-10-22 10:09:04 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 2/91 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 159.203.159.100 - Registrar in stored WHOIS data: Surge.sh - Last stored HTTP status: 451 - Registration date (registry RDAP, surge.sh): 2014-07-25 23:10:53 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a03d98-19b9-738c-b3d7-cb21ebd83fde/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ragebait.surge.sh - Certificate Transparency search: https://crt.sh/?q=%25.ragebait.surge.sh - Web Archive lookup: https://web.archive.org/web/*/https://ragebait.surge.sh/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview ragebait.surge.sh is an impersonation phishing page that presents itself as "Network Dapps | Wallet & DApp Support for Crypto Users." It targets people who are having trouble with a wallet or decentralized app and are looking for help. PhishDestroy first flagged it on 2026-08-26. As of 2026-10-19 the site was still online and serving its phishing content. How the scam works Fake "wallet support" portals like this one promise to fix failed transactions, stuck tokens, sync errors or airdrop claims. To start the "fix," the visitor is asked to connect a wallet or to type in a recovery phrase or private key. Anyone who hands over a seed phrase gives the operators full control of that wallet, and they can empty it at once. A wallet connection can also be used to push malicious approvals that let the attacker move tokens later. Real wallet and DApp teams never ask for a recovery phrase through a website. Evidence ScamSniffer lists the domain on its blocklist, and PhishDestroy lists it too. ScamSniffer focuses on Web3 phishing, so its listing is independent support for the wallet-targeting classification. On VirusTotal, only Fortinet and Gridinsoft flagged the site, 2 of 91 engines as of 2026-10-06. That low count means most browser and antivirus protections will probably not warn a visitor before the page loads. Infrastructure The page sits on a subdomain of Surge.sh, a static-site publishing platform. On a platform like this, anyone can set up a page in minutes with no domain purchase, which makes it cheap to replace when one address gets blocked. The content is served from DigitalOcean, LLC infrastructure in the United States. Its HTTPS certificate is a standard domain-validated one from Sectigo, so the padlock only means the connection is encrypted. It does not mean the site is genuine. What to do If you typed a recovery phrase or private key on this site, treat the wallet as compromised. Create a new wallet with a fresh phrase on a device you trust, and move any remaining funds there right away. If you only connected a wallet, use a token-approval checker to review your approvals and revoke any you do not recognize. Ignore follow-up messages from "support agents" offering to recover lost funds, because that is a common second-stage scam. Defenders should block the full subdomain, report it to Surge.sh and DigitalOcean for takedown, and watch for related Surge.sh subdomains that reuse the "Network Dapps" branding. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a03d98-19b9-738c-b3d7-cb21ebd83fde/ VirusTotal report: https://www.virustotal.com/gui/domain/ragebait.surge.sh Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ragebait.surge.sh Archived copy: https://web.archive.org/web/20260826103225/https://ragebait.surge.sh/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:59:10 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Fb1hPN2g/4c0c438192fa.png Captured: 2026-08-26 10:24:22 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a03d98-19b9-738c-b3d7-cb21ebd83fde.png Captured: 2026-08-26 10:24:22 UTC Source report: https://urlscan.io/result/01a03d98-19b9-738c-b3d7-cb21ebd83fde/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:31:07Z", "uuid": "01a03d98-19b9-738c-b3d7-cb21ebd83fde", "scanned_at": "2026-08-26T10:23:00Z", "final_url": "https://ragebait.surge.sh/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://ragebait.surge.sh/", "from": "http://ragebait.surge.sh/", "status": 307 } ], "ip": "138.68.112.220", "ips": [ "138.68.112.220" ], "asns": [ "14061" ], "countries": [ "DE" ], "doc_hash": "125774fcb2e0e1a366d9b2dd907a973289b9abef739af70af52602deb0ba0206", "script_hashes": [ "96820326ae1479b2615373535b94997f73d4aed929f226fe96725fadde43785b" ], "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart" ], "tls": { "san": [ "*.surge.sh", "surge.sh" ], "cipher": "AES_256_GCM", "issuer": "Sectigo Public Server Authentication CA DV R36", "subject": "*.surge.sh", "protocol": "TLS 1.3", "valid_to": "2026-12-16T23:59:59Z", "valid_from": "2026-06-01T00:00:00Z" }, "domain_age_days": 0, "apex_age_days": 4205, "tls_age_days": 86, "tls_valid_days": 198, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 56, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Surge", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T05:58:54Z", "uuid": "0b4be38b-ab36-47b0-913b-13df6c48bf8e", "scanned_at": "2026-08-26T11:06:07Z", "final_url": "https://ragebait.surge.sh/", "status": 200, "history": [ { "url": "https://ragebait.surge.sh/", "status": 200 } ], "dom_hash": "cf6bbea8c2e9386156533a0e20214167b31517bbfadb0a3590ff434e07df95de", "doc_hash": "125774fcb2e0e1a366d9b2dd907a973289b9abef739af70af52602deb0ba0206", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ragebait.surge.sh", "type": "A", "value": "138.197.235.123" } ], "dnssec_valid": false, "ip": "138.197.235.123", "whois": { "registrar": "Porkbun LLC", "created": "2014-07-25T23:10:53Z", "updated": "2026-08-11T20:27:40Z", "expires": "2027-07-25T23:10:53Z", "nameservers": [ "ns1.surge.world", "ns2.surge.world", "ns3.surge.world", "ns4.surge.world" ] } } } ```