business-security-center[.]surge[.]sh

On July 24, 2026 the domain business-security-center.surge.sh was observed hosting a page titled “Meta Business Support”. The site was registered through the Surge.sh platform and uses the provider’s default nameservers ns1.surge.sh and ns2.surge.sh. DNS resolution points to the IP address 138.197.235.123, which belongs to DigitalOcean, LLC (AS14061) and is geolocated in the United States. An SSL certificate issued by Sectigo Limited, signed by the Sectigo RSA Domain Validation Secure Server CA, was present, confirming the use of a valid TLS certificate despite the malicious intent.

HTTP requests return a 404 status, indicating that the content is no longer available; the domain has been taken offline. VirusTotal scans recorded eight detections out of ninety‑five participating security vendors, and the domain appears on a single external blocklist. PhishDestroy has also listed the site as blocked. The intelligence classifies the campaign as social‑media phishing, targeting users of Meta’s business services, although the exact phishing vector and credential‑harvesting page have not been captured.

Defenders should continue to monitor the associated IP address for any re‑use, enforce blocklists that include this domain, and consider adding the IP to network‑level deny lists. Because the TLS certificate is legitimate, conventional certificate‑based trust checks will not flag the site; detection should rely on content‑based or reputation‑based signals. At present no further artifacts such as malware payloads or command‑and‑control infrastructure have been identified, so the primary mitigation focus remains on domain and IP reputation controls.