user-panel-apply-blue-badge[.]surge[.]sh

This domain, user-panel-apply-blue-badge.surge.sh, is actively flagged as a phishing site. VirusTotal reports that 14 of 91 scanned security vendors have identified the host as malicious, indicating a moderate consensus of detection across multiple engines. DNS resolution points to the IPv4 address 188.166.132.94; no alternative A or AAAA records are observed, and the authoritative nameserver information is unavailable (NS_NOT_FOUND), which may reflect a misconfigured or deliberately hidden name server setup. Registration details show the domain was provisioned through the Surge.sh hosting platform, a service commonly used for rapid static site deployment, but no further registrant metadata is disclosed.

The domain appears on two independent phishing blocklists, specifically PhishDestroy and OpenPhish, and has been added to at least two broader security blocklists. These listings corroborate the VirusTotal findings and reinforce the classification of the site as a phishing vector. No SSL/TLS certificate data, HTTP response codes, page title, or content analysis are currently available, limiting insight into the exact payload or credential‑harvesting mechanisms employed. Given the confirmed detections and blocklist presence, defenders should treat any traffic to this host as malicious.

Recommended actions include adding the domain and its resolved IP address to outbound web filtering rules, updating intrusion‑prevention signatures, and monitoring network logs for connections to 188.166.132.94. Because the hosting provider is a generic static‑site service, additional scrutiny of other Surge.sh subdomains may be warranted. Until further forensic analysis of the site’s content is performed, the safest posture is to block the domain entirely and alert end‑users to avoid any unsolicited requests that reference the “user‑panel‑apply‑blue‑badge” naming pattern.