add-a-restrictions[.]surge[.]sh

This domain, add-a-restrictions.surge.sh, is flagged as a high-risk fake login portal designed to harvest user credentials. Analysis indicates the infrastructure is actively targeting individuals through deceptive login interfaces, a common tactic in credential phishing campaigns. The threat type is classified as a fake login page, which mimics legitimate services to trick users into submitting sensitive information such as usernames, passwords, and multi-factor authentication codes. Infrastructure analysis reveals the domain is hosted on Surge.sh, a platform often exploited for rapid deployment of phishing pages. It resolves to the IP address 188.166.132.94, located in Canada under AS14061 (DigitalOcean, LLC). The SSL certificate is issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36), a common certificate authority that does not inherently validate the legitimacy of the hosted content. VirusTotal reports 8 out of 95 security vendors flagging this domain as malicious, and it appears on at least one security blocklist. The page title is currently unavailable, which may indicate obfuscation techniques or dynamic content generation to evade detection. To mitigate risks associated with this fake login portal, organizations and individuals should implement the following measures: Immediately block the domain add-a-restrictions.surge.sh and its resolving IP 188.166.132.94 at the network perimeter. Deploy email and web filtering rules to prevent delivery or access to this domain. Educate users on identifying phishing attempts, particularly those involving fake login pages, by verifying URLs, checking for SSL certificate anomalies, and scrutinizing unexpected login prompts. Monitor for unauthorized access attempts or credential reuse stemming from this campaign. If credentials were entered on this domain, reset them immediately and enable multi-factor authentication on all critical accounts.