refund-meta[.]surge[.]sh

The domain refund-meta.surge.sh was observed serving a page titled “Facebook Ads Guide” and is explicitly flagged as a Facebook brand impersonation campaign. Infrastructure analysis shows the hostname resolves to the IP address 138.197.235.123, which belongs to the DigitalOcean, LLC network (AS14061) located in the United States. The domain is hosted on the Surge.sh platform, as indicated by the authoritative name servers ns1.surge.sh and ns2.surge.sh, and the registration was performed through the Surge.sh service. A TLS certificate issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA validates the hostname, confirming that HTTPS connections were available at the time of capture.

HTTP requests to the site return a 404 status, suggesting the content was removed or the site is no longer serving the malicious page. VirusTotal scans recorded 12 of 95 antivirus and URL‑reputation engines flagging the domain, demonstrating a moderate detection consensus across independent scanners. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy sinkhole, reinforcing the view that the host was used for malicious purposes. The listed scam type is “Social Media Phishing,” consistent with the Facebook brand targeting observed in the page title.

No additional threat‑actor attribution or malware payload details are presently available. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any re‑use of the underlying IP address or Surge.sh name servers, and add the domain to internal watchlists. Because the site is currently offline, any future re‑hosting on the same infrastructure would likely repeat the same impersonation pattern, so rapid detection of new DNS resolves to the same IP or Surge.sh hostnames is advisable.