solutionapp[.]surge[.]sh

Analysis of the domain solutionapp.surge.sh indicates that it is currently offline but was previously identified as a crypto‑scam phishing site. The domain resolves to the IP address 188.166.132.94, which belongs to DigitalOcean, LLC (AS14061) and is geolocated in the Netherlands. DNS records show the authoritative nameservers ns1.surge.sh and ns2.surge.sh, confirming that the domain was provisioned through the Surge.sh hosting platform. An SSL certificate issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA was present, and the page title returned by the server was "Web Connect".

HTTP probing returned a 404 status code, suggesting that the malicious landing page is no longer reachable. Threat intelligence sources have flagged the domain on two security blocklists, and it is listed as blocked by both PhishDestroy and ScamSniffer. VirusTotal analysis recorded detections from seven of ninety‑five scanning engines, reinforcing the malicious classification. The known scam type is a crypto scam, although the specific campaign details, targeted cryptocurrency, or victim interaction flow have not been disclosed.

Uncertainty remains regarding the exact content that was served before the site went offline, as no page capture is available. No additional indicators such as malicious payload hashes, command‑and‑control endpoints, or phishing email samples have been reported. Defenders should continue to block solutionapp.surge.sh at the DNS and proxy layers, monitor for any re‑registration of the domain or similar subdomains on the same hosting provider, and include the associated IP address in threat‑intel feeds. Regular re‑scanning of the domain, if it reappears, is advised to capture any new malicious artifacts.