surl[.]gd

Surl.gd is a malicious domain engaged in brand impersonation targeting the across brand, operating as a crypto drainer to steal digital assets. The domain is currently offline, but its infrastructure remains a threat if reactivated. This site was registered on January 2, 2025, through Ascio Technologies Inc. Danmark, and resolves to IP 104.21.87.189 with an SSL certificate from Google Trust Services. Security analysis reveals that 17 out of 95 VirusTotal vendors flagged the domain as malicious, and it appears on 2 security blocklists. AlienVault OTX has recorded 18 threat intelligence pulses associated with this domain, indicating widespread recognition among security researchers. The page title, "Surl.gd - shortened links service from Surli," is a deceptive attempt to present itself as a legitimate URL shortening service. Despite being taken offline, users should remain vigilant as the domain could be revived. PhishDestroy recommends avoiding any interaction with surl.gd, blocking the domain at the network level, and educating users about crypto drainer threats. If any credentials or cryptocurrency wallets were exposed, they should be rotated or secured immediately.