ca-info-assistance-clientelle[.]surge[.]sh

Analysis of ca-info-assistance-clientelle.surge.sh indicates that the domain is currently offline, returning an HTTP 404 status with a page title of “Unavailable.” The site was registered through the free‑hosting provider Surge.sh, using the default nameservers ns1.surge.sh and ns2.surge.sh, and resolves to the IP address 188.166.132.94. The IP is announced by AS14061 DigitalOcean, LLC and geo‑located in the Netherlands. An SSL certificate issued by Sectigo Limited (Sectigo RSA Domain Validation Secure Server CA) is present, confirming that TLS is enabled despite the lack of active content. Google Safe Browsing has flagged the domain for social‑engineering, and the domain appears on one public security blocklist.

PhishDestroy has also listed the domain as blocked. VirusTotal reports that 15 of 95 scanning engines have flagged the domain, reinforcing the suspicion of malicious use. The combination of a free‑hosting registrar, a generic sub‑domain pattern, and multiple security vendor detections aligns with a typical generic phishing infrastructure.

What remains uncertain is the exact phishing payload or lure that was delivered when the site was active; the current 404 page provides no visible content, and no additional forensic artifacts (such as login‑capture forms or redirect chains) have been recovered. Defenders should proactively block the domain and associated IP address at perimeter defenses, monitor for other surge.sh subdomains exhibiting similar naming conventions, and incorporate the SSL fingerprint and DNS records into threat‑intel feeds. Continued observation of the hosting provider’s sub‑domain space is advised, as free‑hosting services are frequently abused for transient phishing campaigns.