verification-info-mise-a-jour[.]surge[.]sh

verification-info-mise-a-jour.surge.sh was observed resolving to the IPv4 address 138.68.112.220, which belongs to the DigitalOcean, LLC network (ASN 14061) hosted in Germany. The domain is registered through the Surge.sh service and uses the authoritative nameservers ns1.surge.sh and ns2.surge.sh, a pattern commonly seen in temporary or fast‑deployment hosting used by malicious actors. An SSL certificate issued by Sectigo Limited, signed by the Sectigo RSA Domain Validation Secure Server CA, is present, indicating that HTTPS connections are possible but does not imply legitimacy. HTTP requests return a 404 status and the page title is reported as “Unavailable”, suggesting that the site is no longer serving content at the time of analysis.

VirusTotal records show that 12 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious use. The domain appears on at least one public blocklist and is listed as blocked by the PhishDestroy feed, which classifies it as a phishing resource. Current threat intelligence categorizes the site as a generic phishing infrastructure, but no specific target brand or credential‑stealing page has been captured. Because the site is offline, active exploitation cannot be confirmed, yet the infrastructure indicators remain relevant for future monitoring.

Defenders should add the IP address 138.68.112.220 to outbound traffic deny lists, monitor DNS queries for the domain and its Surge.sh nameservers, and ensure that any inbound connections to the associated SSL certificate are inspected. Continuous re‑query of public blocklists and VirusTotal is recommended to capture any re‑activation. Organizations using email or web filtering should retain the domain in block policies until the hosting provider removes it or the domain is fully taken down.