positions[.]surge[.]dev

PhishDestroy identifies positions.surge.dev as an active generic phishing domain masquerading as a corporate liquidation portal under the Surge brand name. The page is hosted on a drainer kit likely designed to harvest corporate credentials or sensitive financial data under the pretense of managing liquidation processes. Surge branding is abused to lend legitimacy to the fraudulent site, leveraging urgency and perceived authority to trick users into entering login or payment information.

This domain resolves to a single static IP address 216.150.1.65 and operates under a valid Let’s Encrypt SSL certificate, which may help it evade basic browser warnings. VirusTotal currently shows 0 detections out of 95 security vendors, indicating either a very new threat or one that has not yet been widely recognized. The domain was registered recently and likely leverages automated registration services to facilitate quick deployment and rotation. Given the absence of detections and clean technical indicators, this domain remains under active investigation while posing immediate risk to uninformed users.

The domain positions.surge.dev is currently active and classified with a status of 'under_investigation'. As of this advisory, there are no public blocklist entries or Google Safe Browsing (GSB) flags associated with the domain. Despite low current detection coverage, the presence of a Let's Encrypt certificate and clean VT score suggests potential for rapid proliferation. Security teams are advised to monitor for SSO login attempts or credential submissions to this domain, implement network-level blocks against 216.150.1.65, and alert users to avoid interacting with any emails or links referencing 'Surge Liquidation Manager'. The remaining risk is assessed as moderate due to the domain’s active status and lack of widespread detection, warranting immediate preventive action.