applay-submission-panelo[.]surge[.]sh

The domain applay-submission-panelo.surge.sh is currently active and identified as a credential theft phishing site. Analysis indicates the infrastructure is designed to harvest user login credentials through deceptive input forms, likely targeting unsuspecting individuals under the guise of a legitimate submission or verification process. No specific brand impersonation has been confirmed, but the generic lure suggests broad targeting across multiple sectors. Infrastructure analysis reveals the domain is hosted on Surge.sh, a platform often utilized for rapid deployment of static phishing pages. It resolves to the IP address 188.166.132.94, located in Canada under AS14061 (DigitalOcean, LLC). The domain has been flagged by 8 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. It appears on at least one security blocklist, and its SSL certificate, issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36), provides no additional trust indicators due to the low validation level. No historical registration data is available, limiting temporal analysis. Current status confirms the domain remains active, posing an ongoing threat to users. Organizations and individuals are advised to block the domain and its associated IP address (188.166.132.94) at the network perimeter. Endpoint protection solutions should be updated to include this domain in real-time filtering rules. Users who may have interacted with the site should reset credentials immediately, particularly if reused across multiple platforms. Monitoring for anomalous login attempts or unauthorized access is recommended for affected accounts.