free-blue-verified-badge[.]surge[.]sh

Analysis as of July 28, 2026 indicates that the host free-blue-verified-badge.surge.sh is currently active and associated with a high-risk generic phishing campaign. The domain is registered through the Surge.sh platform, and its authoritative name server record could not be retrieved (NS_NOT_FOUND). Network resolution points to the single IPv4 address 159.203.159.100. No additional hosting or ASN metadata is disclosed in the available intelligence.

The domain has been listed on one external security blocklist and is actively blocked by the PhishDestroy service. VirusTotal has recorded 19 positive detections out of 91 scanning engines, confirming that a notable proportion of commercial scanners classify the site as malicious. No public SSL certificate details, HTTP response codes, or page-title information are presently available, limiting visibility into the payload delivered by the site. The lack of a published page title means that content-level analysis has not yet been performed, and the specific phishing lure cannot be described beyond the generic classification supplied.

Given the confirmed presence on a blocklist, the multiple VirusTotal detections, and the high-risk rating, defenders should treat any traffic to free-blue-verified-badge.surge.sh as hostile. Recommended mitigations include adding the domain and its resolving IP address to DNS-based deny lists, configuring web-proxy or gateway filters to block HTTP/HTTPS requests to the host, and monitoring for any outbound connections to the IP 159.203.159.100. Incident response teams should also consider capturing DNS query logs for the domain to detect internal resolution attempts and, where feasible, deploying sinkhole redirects to isolate potential victims. Continuous re-evaluation is advised, as further threat-intel sources may later disclose additional artifacts such as SSL fingerprints, page content, or associated command-and-control infrastructure.