lifetime-freeblue-badge[.]surge[.]sh

This domain, lifetime-freeblue-badge.surge.sh, poses a high-risk credential theft threat by impersonating a legitimate verification process, likely targeting users seeking account validation or badges. Analysis indicates the domain mimics authentication portals to harvest login credentials, potentially leading to unauthorized account access or further social engineering attacks. The specific focus appears to be on users expecting verification badges, a common tactic in credential harvesting schemes. Infrastructure analysis reveals the domain is hosted on Surge.sh, a platform often exploited for rapid deployment of phishing pages. It resolves to IP address 159.203.159.100, located in the US under AS14061 (DigitalOcean, LLC). The SSL certificate is issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36), a common provider for both legitimate and malicious domains. VirusTotal detection shows 12 out of 95 security vendors have flagged this domain as malicious, while it appears on at least one security blocklist. The domain remains active as of the latest verification, with no page title available, suggesting minimal effort to appear legitimate. Users who have visited lifetime-freeblue-badge.surge.sh or entered credentials on the site should immediately revoke any sessions associated with the affected account. Reset passwords using a secure, unrelated device and enable multi-factor authentication if not already active. Monitor the account for unauthorized activity, including logins from unfamiliar locations or devices. If financial or sensitive personal information was submitted, consider reporting the incident to relevant authorities and credit monitoring services. Network administrators should block the domain and its resolving IP (159.203.159.100) at the perimeter to prevent further access.