morpho[.]airdrpsalerts[.]info

This domain, morpho.airdrpsalerts.info, is flagged as a credential harvesting phishing site targeting Gmail users. Analysis indicates the site impersonates Google’s login interface, presenting a page titled 'Google' to deceive users into submitting account credentials. The infrastructure is designed to mimic legitimate authentication portals, increasing the likelihood of successful compromise for users unaware of the fraudulent nature of the domain. Technical evidence confirms elevated risk: the domain is detected by 13 out of 95 security vendors on VirusTotal, appears on one security blocklist, and lacks SSL encryption. It was registered through Cloudflare, Inc., and resolves to the IP address 172.253.62.104, geolocated to the United States under AS15169 (Google LLC). Despite the IP association with a legitimate provider, the domain itself exhibits no valid certificate and operates without secure transport layer protocols, a common indicator of malicious intent. Users who visited morpho.airdrpsalerts.info or entered credentials on the site should immediately reset their Gmail passwords and enable multi-factor authentication. All active sessions should be reviewed and terminated if suspicious activity is detected. System administrators are advised to block the domain and IP at the network perimeter and monitor for credential reuse across internal systems. The domain is currently offline, but similar infrastructure may reappear under different names.