morpho[.]app-airdropalert[.]lat

This domain, morpho.app-airdropalert.lat, was registered on 10 November 2025 through Dynadot LLC. DNS records show it is delegated to the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The A record resolves to 142.250.185.68, an address owned by AS15169 Google LLC located in the United States. No TLS certificate is presented, indicating the site was served without HTTPS. The HTTP response returned a page with the title “Google”, matching the declared impersonation of the Google brand. VirusTotal scans have recorded 13 detections out of 95 participating security vendors, confirming that multiple engines classify the domain as malicious.

The domain is listed on at least one public blocklist, PhishDestroy, and its current service status is offline, suggesting the site has been taken down or is otherwise inaccessible. The intelligence tags the activity as a crypto‑scam, though the exact payload or payment mechanism has not been observed. The combination of a legitimate Google IP address, lack of SSL, and a page title that mimics a trusted brand is a typical pattern used to increase credibility in phishing or fraud campaigns. The precise content of the page, including any forms or malicious scripts, has not been captured because the site is currently offline, leaving the exact attack vector unknown. At this time, no additional threat‑intel sources such as OTX or Google Safe Browsing have been reported for this host.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for similar sub‑domains that resolve to the same Google IP range, and consider adding the observed Cloudflare name servers to watchlists. Ongoing surveillance of the registrar Dynadot for bulk registrations and of the host’s IP reputation is advised. Because the site is offline, active exploitation cannot be confirmed, but the existing vendor detections and blocklist listing indicate a high likelihood of malicious intent.