morpho[.]portal-hubs[.]lat

The domain morpho.portal-hubs.lat was observed on July 22, 2026 and classified as a brand‑impersonation threat targeting Google. Registration data shows it was created on October 21, 2025 through Dynadot LLC, and the authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare’s DNS infrastructure. DNS resolution points to IP address 142.250.185.228, which is owned by AS15169 Google LLC and located in the United States, suggesting the attacker deliberately leveraged a legitimate Google IP range to increase credibility. No TLS certificate was presented, meaning the site would have been served over plain HTTP if it were reachable.

The page title returned by the HTTP response was simply "Google", matching the declared brand target. VirusTotal analysis recorded 2 detections out of 95 scanned security vendors, and the domain appears on a single external blocklist. Gridinsoft assigned a trust score of 0 / 100, and the domain was actively blocked by the PhishDestroy sinkhole, after which its status was reported as offline. The available evidence confirms the presence of a brand‑impersonation campaign that exploits a legitimate Google IP address and minimal visual cues to deceive users.

However, the lack of an SSL certificate, the offline status, and the absence of a publicly captured payload limit the ability to assess the full phishing workflow or any credential‑harvesting mechanisms. Defenders should immediately add morpho.portal-hubs.lat to network‑level blocklists, enforce DNS filtering, and monitor for any resurgence of the domain or similar patterns that resolve to Google‑owned IP ranges. Continuous re‑scanning with multi‑vendor services is recommended to capture any future changes in detection status or content hosting.