app[.]morpho[.]casa

The domain app.morpho.casa was registered on April 02, 2026 through Dynadot Inc. It is hosted on Cloudflare’s network (IP 188.114.96.3, location CA) and uses two Cloudflare nameservers (alexa.ns.cloudflare.com, randall.ns.cloudflare.com). The site presents a TLS certificate issued by Let’s Encrypt (certificate identifier E8) and currently returns HTTP 403 responses. The page title observed is "Just a moment...". Reputation data shows a Gridinsoft trust score of 0 out of 100, indicating a lack of credibility. VirusTotal analysis recorded three detections out of ninety‑four scanners, and the domain appears on one security blocklist. It has been actively blocked by PhishDestroy and is listed as a high‑risk, generic phishing threat. The infrastructure suggests a freshly created phishing operation that leverages Cloudflare’s CDN to obscure its origin. While the exact phishing payload has not been publicly disclosed, the combination of a low trust score, multiple vendor detections, and active blocklisting warrants immediate mitigation. Defenders should add the domain and its IP address to network deny lists, monitor DNS queries for the associated nameservers, and consider sinkholing the IP range to disrupt further activity. Continuous re‑evaluation is advised as additional threat intelligence may emerge.