tick-trust-verify[.]surge[.]sh

The domain tick-trust-verify.surge.sh has been identified as a phishing infrastructure impersonating Facebook, specifically targeting users through a credential theft scheme. Analysis indicates the site was designed to mimic Facebook’s verification process, as evidenced by the page title 'Facebook Blue Tick Center.' The domain is currently offline, though it remains a documented case of brand impersonation with elevated risk indicators. Infrastructure analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, indicating moderate detection but persistent threat potential. It was registered through Surge.sh, a platform often exploited for rapid deployment of phishing pages, and resolved to the IP address 138.197.235.123, associated with AS14061 (DigitalOcean, LLC) in the United States. The SSL certificate was issued by Sectigo Limited under the 'Sectigo RSA Domain Validation Secure Server CA' authority. The domain appeared on two security blocklists, including PhishDestroy and PhishingDB, further confirming its malicious classification. Current status confirms the domain has been taken offline, though residual risk remains due to the transient nature of such infrastructure. Organizations and users are advised to monitor for similar domains leveraging Surge.sh or DigitalOcean-hosted IPs, particularly those impersonating Facebook’s verification or login portals. Network defenders should update blocklists to include this domain and its associated IP, while end-users should verify the authenticity of any Facebook-related verification pages through official channels only. Proactive monitoring of SSL certificate issuance patterns for domains mimicking major brands is recommended to detect emerging threats.