submit-application[.]surge[.]sh

Analysis of the domain submit-application.surge.sh indicates active malicious infrastructure targeting users with a generic phishing campaign. The domain resolves to the IPv4 address 159.203.50.177, which is associated with the Surge.sh hosting platform. Registration details show that the domain was created through the Surge.sh registrar, and the authoritative nameserver information is currently unavailable (NS_NOT_FOUND). VirusTotal records demonstrate that 15 of 95 scanned security vendors have flagged the domain, providing a moderate consensus of malicious behavior.

Independent threat‑intelligence feeds corroborate the assessment: the domain is listed on two public blocklists and is explicitly blocked by PhishDestroy and OpenPhish, reinforcing its classification as a high‑risk phishing resource. The threat level is designated as high, and the status remains active as of the report date, July 22, 2026. No additional attributes such as SSL certificate details, HTTP response codes, or page titles have been disclosed, leaving those vectors unverified.

Defenders should prioritize immediate containment by adding the domain and its resolved IP address to deny‑list rules across perimeter firewalls, DNS filtering services, and endpoint protection suites. Continuous monitoring of the IP space and associated Surge.sh sub‑domains is advised, given the platform’s propensity for rapid provisioning of malicious sites. Organizations should also enforce user awareness training that highlights the risks of unsolicited application submission portals, as the domain’s naming pattern suggests an attempt to lure victims into providing personal credentials.