alive1-kittens[.]surge[.]sh

The domain alive1-kittens.surge.sh was observed returning an HTTP 404 response and reporting the page title “Unavailable”. The zone is hosted on the Surge.sh platform, as indicated by the authoritative nameservers ns1.surge.sh and ns2.surge.sh and by the registrar information that lists Surge.sh as the registrant. DNS resolution points to the IP address 138.197.235.123, which belongs to AS14061 DigitalOcean, LLC and is geolocated in the United States. The server presents a Sectigo RSA Domain Validation certificate issued by Sectigo Limited, confirming that TLS termination is performed by the hosting provider rather than the attacker.

Threat intelligence feeds have flagged the domain for social engineering under Google Safe Browsing, and 14 of 95 VirusTotal scanners have issued detections, confirming malicious intent. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, indicating that remediation actions have already been taken. Current monitoring shows the site is offline, suggesting that the phishing campaign has been taken down or moved to a new location. Because the infrastructure relies on a shared cloud provider, future campaigns may reuse the same IP range or create new sub‑domains under the surge.sh namespace.

Defenders should continue to block the specific domain and its associated IP, add the IP range to network‑level deny lists, and monitor for newly registered surge.sh sub‑domains that resolve to the same DigitalOcean ASN. Ongoing correlation with other phishing indicators is recommended to detect potential re‑use of the hosting environment. Until additional content becomes available, the exact phishing payload and targeted brand remain unknown.