all-done-form-here-me[.]surge[.]sh

On August 01, 2026 analysts observed that the domain all-done-form-here-me.surge.sh remains active and is classified as a high‑risk generic phishing site. The domain is hosted on the Surge.sh platform, which provides free static‑site hosting, and resolves to the IPv4 address 159.203.50.177. No authoritative nameserver records were returned for the domain, indicating that standard DNS queries do not expose a conventional NS set. VirusTotal has logged 19 detections out of 91 scanned security vendors, confirming that multiple anti‑malware engines flag the host as malicious. The domain appears on two public phishing blocklists and is explicitly listed by PhishDestroy and OpenPhish, reinforcing its reputation as a phishing resource.

The registrar information points to Surge.sh as the registration service, but registration dates and ownership details are not disclosed in the available data. The current evidence does not include a page title, SSL certificate details, HTTP response codes, or any Safe Browsing verdicts, leaving the exact content and delivery mechanisms of the site undocumented. Consequently, analysts cannot confirm which credential‑harvesting forms or targeted brands, if any, are employed. The lack of visible nameserver data and the reliance on a free‑hosting provider suggest a low‑cost, rapidly deployed infrastructure that can be recreated if takedown actions succeed.

Defenders should immediately block all‑done‑form‑here‑me.surge.sh at the DNS and proxy layers, add the associated IP 159.203.50.177 to network‑level deny lists, and monitor traffic for any outbound connections to that address. Continuous re‑scanning on VirusTotal and inclusion in internal phishing‑detection feeds are advised to capture any changes in detection scores. Organizations using web‑filtering solutions should ensure that the domain is present in both PhishDestroy and OpenPhish feeds, and consider adding the domain to custom blocklists. Ongoing observation of the Surge.