meta-ads-refund[.]surge[.]sh

Analysis of the domain meta-ads-refund.surge.sh indicates it is a confirmed brand impersonation campaign targeting Facebook, classified as a social media phishing scam. The domain was flagged by 11 of 95 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy, which has blocked access to the site. Infrastructure analysis reveals the domain was registered through Surge.sh, a free static web hosting service often exploited for phishing due to its low barrier to deployment. The page title, 'Facebook Ads Guide,' aligns with the identified scam type, suggesting an attempt to deceive users into believing the site offers legitimate Facebook advertising resources or refunds.

The domain resolved to IP address 188.166.132.94, hosted on DigitalOcean’s AS14061 network in the Netherlands, a common hosting provider for both legitimate and malicious sites. The SSL certificate, issued by Sectigo Limited, is valid and typical for phishing domains seeking to appear trustworthy. As of July 25, 2026, the domain returns an HTTP 404 status, indicating it has been taken offline, though this does not preclude future reactivation under the same or a similar domain.

Defenders should treat this domain as malicious and maintain blocking rules, as the infrastructure and hosting provider have been previously associated with phishing activity. The exact content of the phishing page is not detailed in available intelligence, but the combination of brand impersonation, hosting on a free service, and detection by multiple security vendors provides strong evidence of malicious intent. Organizations are advised to monitor for related domains using the same hosting provider or naming patterns, as threat actors frequently reuse infrastructure for subsequent campaigns.