furtive-rock[.]surge[.]sh

Analysis of the domain furtive-rock.surge.sh indicates that it was actively serving a phishing page before being taken offline. HTTP queries return a 404 status, and the page title reported by scanners is "Unavailable," suggesting the content was removed or the site is no longer reachable. DNS resolution points to the IP address 138.68.112.220, which is hosted in Germany and belongs to AS14061 DigitalOcean, LLC. The domain uses the default Surge.sh nameservers (ns1.surge.sh and ns2.surge.sh) and was registered through the Surge.sh service, a common platform for rapid site deployment. SSL inspection reveals a Sectio Limited certificate issued by the Sectigo RSA Domain Validation Secure Server CA, confirming the presence of a valid TLS layer but offering no insight into the underlying payload.

Google Safe Browsing has flagged the domain for social engineering, and 15 of 95 VirusTotal security vendors have marked it as malicious, reflecting a moderate consensus among antivirus engines. The domain appears on one external security blocklist and has been specifically blocked by PhishDestroy, indicating that at least one dedicated anti‑phishing organization has taken action against it. Technological analysis identified the use of Sectigo services, consistent with the observed certificate.

While the exact phishing lure, target brand, or credential‑stealing kit cannot be confirmed from the available data, the combination of a 404 response, social‑engineering Safe Browsing label, and multiple vendor detections points to a high‑risk phishing infrastructure that was recently decommissioned. Defenders should continue to block the domain at the DNS and network level, monitor the associated IP address for any resurgence, and update detection signatures to reflect the observed certificate and blocklist identifiers. Ongoing observation of the IP’s activity and periodic re‑scans are recommended to capture any re‑use of the infrastructure for future campaigns.