morpho[.]airdrpsalert[.]cfd

This domain, morpho.airdrpsalert.cfd, is flagged as a phishing site impersonating Google. Registered on October 22, 2025, through Dynadot LLC, it resolves to the IP address 172.217.18.4, which is associated with AS15169 (Google LLC) in the United States. Infrastructure analysis reveals the domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting details and evade detection. At the time of assessment, the domain is offline, though it was previously active and blocked by at least one security vendor (PhishDestroy).

The page title was recorded as 'Google,' aligning with the reported brand impersonation. No SSL certificate was detected, which is atypical for legitimate services but consistent with hastily deployed phishing infrastructure. Detection data indicates the domain was flagged by 11 of 95 security vendors on VirusTotal, suggesting moderate consensus among threat intelligence sources. However, the absence of additional context—such as the specific phishing kit used, redirect chains, or payload delivery mechanisms—limits further classification.

Defenders should treat this domain as confirmed malicious based on its registration details, blocklist status, and association with known phishing patterns. Network-level blocking is recommended, particularly for environments where Google services are in use. Given the domain’s recent creation and lack of SSL, it is unlikely to have been legitimately repurposed. Monitoring for re-activation or related domains with similar naming conventions (e.g., variations of 'airdrpsalert') may help preempt future campaigns.