morpho[.]airsdropsalerts[.]cfd

The domain morpho.airsdropsalerts.cfd is a confirmed phishing site engaged in brand impersonation targeting Google. It presents itself as an official Google login page to deceive users into entering credentials, posing an elevated risk of account compromise. No crypto drainer kit was identified. The site is currently taken offline, but prior activity indicates it was actively used for credential theft.

Technical analysis shows morpho.airsdropsalerts.cfd was flagged by 8 of 95 VirusTotal security vendors, including ChainPatrol and CyRadar, and appears on 1 security blocklist (PhishDestroy). The domain was registered on 2025-11-07 04:34:31 through Dynadot LLC and resolves to the IP address 142.250.181.228, hosted on Google LLC's infrastructure (AS15169). No SSL certificate was issued, and the observed page title was 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Google Safe Browsing did not flag the domain at the time of assessment.

Users who may have interacted with morpho.airsdropsalerts.cfd should immediately change their Google account password and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google’s abuse form and to the registrar, Dynadot LLC, to aid in takedown efforts. If credentials were reused on other platforms, update those passwords as well.