a-free-rewards[.]surge[.]sh

Analysis of a-free-rewards.surge.sh indicates that the domain is presently offline, returning HTTP 404 and displaying the page title "Unavailable." The site was hosted on Surge.sh infrastructure, as reflected by the authoritative nameservers ns1.surge.sh and ns2.surge.sh, and the SSL certificate was issued by Sectigo Limited under the Sectero RSA Domain Validation Secure Server CA chain. Network resolution points to a single IPv4 address, 188.166.132.94, which belongs to DigitalOcean, LLC (AS14061) and is geolocated in the Netherlands. The domain was flagged by PhishDestroy and appears on one external security blocklist.

VirusTotal scans show that 13 of 95 antivirus and URL‑reputation engines flagged the domain as malicious, reinforcing the suspicion of abuse. Scamadviser assigned a trust score of 1 out of 100, underscoring the low credibility of the host. The listed scam type is a "Fake Airdrop," suggesting an attempt to lure victims with a counterfeit cryptocurrency reward scheme.

While the exact payload or credential‑harvesting page cannot be confirmed because the site is offline, the combination of a low trust score, multiple vendor detections, blocklist inclusion, and the airdrop narrative aligns with typical phishing infrastructure. Defenders should continue to block the domain at perimeter defenses, monitor the associated IP address for any re‑use in future campaigns, and update URL‑filtering and threat‑intel feeds with the observed indicators. Ongoing observation of the IP range owned by DigitalOcean may reveal related activity, and security teams should advise users to avoid any unsolicited communications referencing a‑free‑rewards or similar airdrop offers.