easy4freeget[.]surge[.]sh

This domain, easy4freeget.surge.sh, is actively engaged in a brand impersonation phishing campaign targeting users of the Meta platform. The page presents itself as an official Meta Verified portal, offering free verification badges to entice victims into entering sensitive credentials or personal information. Analysis of the page title, 'Meta Verified — Free Badge,' confirms the intent to deceive users into believing they are interacting with a legitimate Meta service, a tactic commonly employed to harvest login credentials or distribute malicious payloads under the guise of account verification. Infrastructure analysis reveals that the domain is hosted on Surge.sh, a static web publishing service often exploited for rapid deployment of phishing pages due to its ease of use and lack of stringent registration requirements. The domain resolves to the IP address 188.166.132.94, located in the Netherlands under AS14061 (DigitalOcean, LLC). Detection metrics indicate that 17 out of 95 security vendors on VirusTotal have flagged this domain as malicious, while it appears on one additional security blocklist. The SSL certificate, issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36), provides minimal assurance, as Domain Validation (DV) certificates are routinely abused in phishing operations to lend a false sense of legitimacy. Users who have visited easy4freeget.surge.sh or interacted with its content are advised to take immediate remedial action. Any credentials entered on the site should be considered compromised and must be changed across all platforms where the same or similar passwords were used. Affected individuals should monitor their accounts for unauthorized activity, including logins from unfamiliar locations or devices. If financial or personally identifiable information was submitted, users are urged to report the incident to relevant fraud prevention authorities and consider implementing additional security measures, such as multi-factor authentication, to mitigate further risk. Browser-based security tools should be updated to ensure future protection against similar threats.