morpho-portal[.]pages[.]dev

The domain morpho-portal.pages.dev was registered on August 17, 2024 through Cloudflare, Inc. It resolves to the IP address 172.66.44.226, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site serves content over HTTPS with a certificate issued by Google Trust Services under the WE1 CA, advertises HTTP/3 support, and enforces HSTS. Nameservers leonidas.ns.cloudflare.com and elle.ns.cloudflare.com show that the entire hosting stack is provided by Cloudflare.

Analysis classifies the domain as a brand‑impersonation campaign targeting the Morpho brand. The only page title observed is “Morpho Labs Early Access | Portal,” which directly references the target organization. The threat type is listed as “Impersonation,” and the domain appears on a single security blocklist. VirusTotal currently flags the domain with 1 out of 95 security vendors, indicating at least one detection of malicious activity.

Reputation signals are extremely poor: Gridinsoft assigns a trust score of 0 / 100, and the domain is blocked by PhishDestroy. An HTTP 200 response confirms that the server returns a valid page rather than a generic error page. No further details about page content, scripts, or credential‑capture mechanisms are provided, leaving the precise tactics of the impersonation campaign unverified.

Defenders should add morpho-portal.pages.dev to DNS‑based and proxy filtering rules that block known impersonation domains. Continuous monitoring of Cloudflare‑hosted assets for new subdomains referencing the Morpho brand is recommended, as the adversary can rapidly provision additional pages under the same provider. Any credential submissions to this domain should be treated as compromised; affected users must be instructed to reset passwords and review account activity.