invited-for-bluefree[.]surge[.]sh

This domain, invited-for-bluefree.surge.sh, is flagged as a high-risk brand impersonation threat targeting Facebook. Analysis indicates the site mimics Meta Verified, a premium verification service, to deceive users into submitting login credentials or personal information. No crypto drainer or malware payloads have been observed in initial scans, but the page structure and visual elements closely resemble official Facebook properties, including the use of Meta branding and Facebook color schemes. The domain operates under the guise of account verification, a common tactic for credential theft campaigns. Infrastructure analysis reveals the domain is hosted on Surge.sh, a free static web publishing service, and resolves to IP 159.203.50.177, located in Canada under AS14061 (DigitalOcean, LLC). The SSL certificate is issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36), a legitimate but frequently abused certificate authority. VirusTotal detection shows 14 out of 95 security vendors flag the domain as malicious, while it appears on one security blocklist. No creation date is publicly available due to Surge.sh's ephemeral hosting model, but the domain remains active and unlisted by Google Safe Browsing at the time of analysis. Current status indicates the domain is still operational, though it has been blocked by at least one security provider. Response actions should include immediate blacklisting, DNS sinkholing for the resolved IP, and monitoring for related subdomains or redirect chains. The remaining risk is elevated due to the domain's active status, low detection rate, and direct impersonation of a high-value brand. Users are advised to verify URLs against official Facebook domains, avoid interacting with unsolicited verification prompts, and report suspicious links to their security teams for further investigation.