morpho[.]beefyapp[.]lol

Analysis of the domain morpho.beefyapp.lol indicates an elevated-risk brand impersonation campaign targeting Google. The domain was registered on October 5, 2025, through Dynadot LLC and currently resolves to the IP address 142.250.181.228, which is associated with AS15169 (Google LLC) in the United States. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), though no SSL certificate is present. The page title, as captured in available metadata, is 'Google,' aligning with the reported brand impersonation objective.

Detection data from July 23, 2026, shows that 13 of 95 security vendors on VirusTotal flagged this domain as malicious, and it appears on at least one security blocklist. The domain was actively blocked by PhishDestroy prior to being taken offline. While the exact content of the site remains unanalyzed, the combination of brand impersonation, absence of SSL, and detection by multiple security vendors suggests a deliberate phishing attempt rather than a benign misconfiguration. Defenders are advised to treat this domain as compromised and prioritize blocking it at the DNS and network levels.

Given the use of Cloudflare infrastructure, monitoring for related subdomains or newly registered domains under the same registrar may help identify follow-on activity. The registration date and hosting on a Google-associated IP warrant further scrutiny, as this may indicate an attempt to exploit perceived legitimacy. No evidence links this domain to a specific phishing kit or broader campaign, and additional forensic data would be required to determine the full scope of the threat.