advertising-refund-center[.]surge[.]sh

Analysis indicates that the domain advertising-refund-center.surge.sh was used to host a page titled “Facebook Advertising Refund Center”, targeting the Facebook brand. The site responded with HTTP 404, suggesting the content was removed or never served, and the domain is currently taken offline. The hosting resolves to IP 188.166.132.94, which belongs to DigitalOcean, LLC (AS14061) and is geolocated in the Netherlands. Registration was performed through the Surge.sh service, with authoritative nameservers ns1.surge.sh and ns2.surge.sh. The TLS certificate presented is issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA, confirming that the domain had a valid HTTPS endpoint at the time of observation.

Threat intelligence shows that the domain is classified as a Social Media Phishing campaign that impersonates Facebook. It appears on a single security blocklist and has been blocked by the PhishDestroy sinkhole. VirusTotal scans recorded 11 detections out of 95 security vendors, indicating a moderate level of malicious consensus. Scamadviser assigns a trust score of 1 out of 100, reflecting extreme risk.

No additional public reports or Safe Browsing entries were identified beyond the listed blocklist. Uncertainty remains regarding the exact phishing kit or the presence of credential‑harvesting forms, as the page content was not captured before the site went offline. Defenders should continue to block the domain and associated IP address at network perimeter devices, monitor for any resurgence of similar Surge.sh subdomains, and incorporate the observed indicators—domain name, IP, SSL issuer, and detection counts—into threat‑intelligence feeds. Ongoing observation of the hosting provider’s sub‑domain issuance patterns may help pre‑empt future impersonation attempts targeting Facebook or other social platforms.