elliallawson-drive-secure-pdf[.]surge[.]sh

PhishDestroy identifies elliallawson-drive-secure-pdf.surge.sh as an active credential theft phishing domain designed to trick users into surrendering login credentials under false pretenses. This site masquerades as a secure PDF drive, exploiting trust in familiar cloud storage terminology to harvest usernames and passwords. The threat is elevated due to its live operation and deliberate impersonation of legitimate services, posing immediate risk to victims’ personal and financial accounts.

This domain was flagged by 9 out of 95 security vendors on VirusTotal, indicating significant suspicion within the cybersecurity community. It resolves to IP address 188.166.132.94 via Surge.sh, a dynamic hosting platform commonly abused in short-lived phishing campaigns. The site uses a Sectigo Limited SSL certificate, which may lend a false sense of legitimacy. While exact registration date is not publicly available due to Surge.sh’s privacy protections, the domain’s immediate detection upon activation highlights its malicious intent.

To mitigate risk, users must avoid clicking links or entering credentials on this domain. Organizations should block 188.166.132.94 and the domain at network and DNS levels. Enable multi-factor authentication (MFA) on all accounts, especially cloud storage and email services, as compromised credentials often lead to further attacks. Report the domain to your security team and file a complaint with the hosting provider (Surge.sh abuse@surge.sh) and platforms like Google Safe Browsing. Always verify URLs manually via official sources before logging in.