morbylu[.]de

Analysis of morbylu.de indicates an active brand-impersonation campaign targeting Binance users. The domain was registered on 21 February 2026 and resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. No SSL certificate is presented, and the web server returns HTTP 200, confirming the site is reachable. The page title observed is "Mor Bylu™ - KI-Trading Deutschland 2026", which does not reference Binance but suggests a purported German AI-trading service, consistent with the declared scam type of brand impersonation.

Reputation services have assigned a Gridinsoft trust score of 0 / 100, and eight of ninety-three VirusTotal scanners flag the domain as malicious. The domain appears on three independent blocklists and is explicitly listed by PhishDestroy, MetaMask, and SEAL, indicating that multiple anti-phishing ecosystems have already taken protective action. Nameservers are algin.ns.cloudflare.com and mimi.ns.cloudflare.com, both hosted by Cloudflare, a common vector for fast-flux or abuse of legitimate CDN services. Uncertainties remain regarding the precise phishing payload, landing page content, and whether any credential-harvesting mechanisms are active, because the site has not been captured in public sandbox analyses.

Defenders should therefore treat morbylu.de as a high-confidence malicious indicator. Recommended mitigations include adding the domain to DNS-based deny lists, configuring proxy or firewall rules to block HTTP 200 responses from the IP 188.114.97.3, and enforcing TLS inspection policies to detect the lack of a valid certificate. Continuous monitoring of Cloudflare-originating abuse reports and periodic re-scanning on VirusTotal or similar platforms are advised to capture any changes in the payload or hosting infrastructure.