info-client-2025-ca[.]surge[.]sh

The domain info-client-2025-ca.surge.sh is currently offline but was previously flagged by multiple security services as a generic phishing site. Google Safe Browsing classified the URL under social engineering, indicating it was used to lure users into disclosing credentials or personal data. VirusTotal recorded detections from 14 of 95 scanned engines, reinforcing the malicious reputation. The site appeared on a single public blocklist and was specifically blocked by PhishDestroy, confirming that at least one anti‑phishing feed recognized the threat. Technically, the domain resolved to the IP address 138.197.235.123, which belongs to AS14061 DigitalOcean, LLC and is geolocated in the United States.

The hosting provider’s infrastructure is typical for short‑lived malicious campaigns. An SSL certificate issued by Sectigo Limited (Sectigo RSA Domain Validation Secure Server CA) was present, suggesting the operators employed a valid TLS certificate to increase perceived legitimacy. DNS resolution used the default Surge.sh nameservers (ns1.surge.sh, ns2.surge.sh), and the domain was registered through Surge.sh, a platform that offers rapid deployment of static sites. HTTP requests returned a 404 status and the page title displayed as "Unavailable," implying that the content has been removed or the site was taken down.

Because the domain is no longer active, direct exploitation is presently halted, yet remnants of the infrastructure may persist or be re‑used for future campaigns. Defenders should continue to block the IP 138.197.235.123 and the domain in network controls, monitor for re‑registration or similar subdomains under the Surge.sh namespace, and maintain vigilance for any resurgence of the certificate fingerprint. Correlation with internal logs for outbound connections to the listed IP or TLS handshakes with the Sectigo certificate can aid in detecting residual activity.