join-now-program[.]surge[.]sh

The domain join-now-program.surge.sh has been identified as a brand impersonation threat targeting Facebook, currently offline. The domain masquerades as a legitimate Facebook Page Support Center, aimed at deceiving users into believing they are interacting with a credible Facebook resource.

The domain was registered through Surge.sh and has been flagged by 14 out of 95 security vendors on VirusTotal. It resolves to the IP address 138.197.235.123, hosted in the United States under AS14061 managed by DigitalOcean, LLC. Its SSL certificate is issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA. The domain has been placed on two security blocklists and is specifically blocked by PhishDestroy and PhishingDB, indicating its malicious intent to impersonate Facebook.

Currently, join-now-program.surge.sh is offline, reducing immediate risk. However, entities should remain vigilant and continue monitoring for similar impersonation attempts. It is recommended to enhance email filtering and educate users on identifying and avoiding phishing schemes that mimic trusted brands like Facebook. Security solutions should be updated regularly to ensure they recognize and block new instances of brand impersonation domains.