formapply-verifiedbadge-now[.]surge[.]sh

On July 29, 2026 the domain formapply-verifiedbadge-now.surge.sh was observed hosting a generic phishing campaign. The domain was registered through the free‑hosting provider Surge.sh and resolves to the IPv4 address 159.203.159.100. No authoritative nameserver records are returned (NS_NOT_FOUND), which is typical for dynamically assigned hosting on the Surge platform. The site is currently listed as active with an elevated risk rating. Multiple defensive feeds have flagged the domain.

PhishDestroy has added it to its blocklist, and it appears on one additional security blocklist. VirusTotal analysis shows that 16 of 91 scanning engines returned a malicious classification, reinforcing the suspicion of phishing use. No public Safe Browsing, Open Threat Exchange, or SSL certificate details were available at the time of analysis, and the HTTP response code could not be retrieved. The page title and any brand targeting have not been disclosed, so the specific lure employed by the site cannot be confirmed.

Given the combination of registrar‑level abuse, malicious detection scores, and blocklist presence, defenders should treat any traffic to formapply-verifiedbadge-now.surge.sh as hostile. Network sensors should block DNS resolution and HTTP/S connections to the domain, and endpoint solutions should quarantine any files or URLs associated with it. Continuous monitoring of the IP address 159.203.159.100 is recommended, as the host may be reused for additional malicious campaigns. Organizations should also update threat intelligence feeds to include this indicator to mitigate future exposure.