donation-don-ca[.]surge[.]sh

The domain donation-don-ca.surge.sh was observed as a high‑risk generic phishing site and is currently offline. Technical investigation shows the domain is hosted on a DigitalOcean infrastructure (AS14061) located in the United States and resolves to the IP address 138.197.235.123. DNS resolution is provided by the authoritative nameservers ns1.surge.sh and ns2.surge.sh, confirming that the domain was registered through the Surge.sh service. An SSL certificate issued by Sectigo Limited, signed by the Sectio RSA Domain Validation Secure Server CA, was present at the time of analysis, indicating that the site employed a valid TLS certificate to appear legitimate.

HTTP probing returned a 404 status code and the page title was reported as "Unavailable," suggesting that the malicious landing page has been removed or is no longer reachable. Reputation services flagged the domain heavily: VirusTotal recorded 12 detections out of 95 scanned security vendors, Google Safe Browsing labeled it as a social‑engineering threat, and the domain appears on one blocklist, specifically PhishDestroy. Scamadviser assigned a trust score of 1 out of 100, reflecting an extremely low credibility rating.

While the precise phishing payload or targeted brand cannot be confirmed from the available data, the convergence of multiple independent detections and the presence on a known phishing blocklist indicate a deliberate attempt to harvest credentials or other sensitive information. Defenders should continue to block the domain at network perimeters, monitor for any residual DNS queries, and ensure that any endpoints that may have cached the site are cleared. Further analysis of any associated URLs or email campaigns that referenced donation-don-ca.surge.sh would be required to fully assess the scope of the campaign.