blue-trick-apply[.]surge[.]sh

Analysis as of July 23, 2026 indicates that the domain blue-trick-apply.surge.sh is currently offline but retains infrastructure characteristics consistent with a Facebook brand-impersonation campaign. The domain resolves to IP 138.197.235.123, which maps to the DigitalOcean network (AS14061) located in the United States. Hosting is provided through Surge.sh, as evidenced by the authoritative name servers ns1.surge.sh and ns2.surge.sh. The TLS certificate presented is a Sectigo RSA Domain Validation certificate issued by Sectigo Limited, a standard DV certificate that does not provide any brand-specific validation. An HTTP request returns a 404 status, and the only visible page title retrieved prior to takedown was “Facebook Page Support Center”, matching the declared impersonated brand.

Reputation data shows the domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans have yielded 12 positive detections out of 95 scanners, reinforcing the malicious classification. Scamadviser assigns a trust score of 1 / 100, reflecting extreme distrust. The listed scam type is “Social Media Phishing”, and the intelligence explicitly states the domain impersonates Facebook. Uncertainty remains regarding the exact content that was served before the site went offline; the 404 response prevents direct verification of login forms or credential-stealing pages.

No additional intelligence such as OTX tags, Safe Browsing identifiers, or malware payload hashes were supplied. Defenders should continue to block the domain at perimeter and DNS layers, add the IP address 138.197.235.123 to any deny lists, and monitor for future reuse of the same hosting account or similar Surge.sh subdomains. Given the low trust score and multiple vendor detections, automated sinkholing or redirect to a warning page is advisable. Continuous re-scanning of the domain, especially if it reappears, will help capture any changes to the payload or page content.