apply-for-reward-t[.]surge[.]sh

On July 23, 2026, the domain apply-for-reward-t.surge.sh was identified as a high-risk phishing infrastructure impersonating Facebook. The page title, 'Facebook Blue Tick Center,' explicitly targets users seeking account verification, a common tactic in social media credential theft. Infrastructure analysis reveals the domain was hosted on Surge.sh, a free static web publishing service, and resolved to 138.197.235.123, an IP address assigned to DigitalOcean, LLC (AS14061) in the United States. The SSL certificate was issued by Sectigo Limited under the 'Sectigo RSA Domain Validation Secure Server CA' chain, a detail consistent with many low-effort phishing deployments. Detection data indicates the domain was flagged by 14 of 95 security vendors on VirusTotal, though the absence of additional context limits conclusions about the specific detection rules triggered.

Google Safe Browsing classified the domain as engaging in social engineering, aligning with its stated scam type. The domain appears on one security blocklist, specifically PhishDestroy, and received a trust score of 1/100 from Scamadviser, reflecting minimal legitimacy. At the time of reporting, the domain returned an HTTP 404 status, suggesting it was taken offline either by the hosting provider or the threat actor. No evidence links this domain to a known phishing kit or campaign beyond its branding as a Facebook verification scam.

The use of Surge.sh nameservers (ns1.surge.sh, ns2.surge.sh) and the static hosting model limit forensic visibility, as logs and dynamic content are typically unavailable. Defenders should treat this domain as part of a broader pattern of Facebook impersonation and prioritize blocking it at the DNS or proxy level. Organizations should also monitor for related domains using the same Surge.sh hosting pattern or targeting similar verification-themed lures.