morpho[.]co[.]at

On review, PhishDestroy identifies morpho.co.at as an active high-risk cryptocurrency phishing domain masquerading as the Morpho Finance 2026 DeFi protocol to harvest wallet credentials and drain funds. The page title explicitly mirrors legitimate Morpho Finance branding while serving a malicious drainer kit intended to trick users into authorizing fraudulent transactions and exfiltrating crypto assets. No formal brand partnership or affiliation exists, confirming intent to deceive within the decentralized finance ecosystem.

Technical indicators confirm the malicious profile: VirusTotal detection stands at only 1 out of 95 scanners (1.05%), the domain was registered through Hosting Concepts B.V. via Registrar.eu, and the resolving IP address is 188.114.97.3. Let’s Encrypt issued the SSL certificate, providing a false sense of legitimacy. While the creation date remains unverified here, the domain remains resolvable and active, indicating ongoing malicious operations. It has not been flagged by Google Safe Browsing and has not yet accumulated broader blocklist coverage, amplifying its current threat window.

Current status assessment shows morpho.co.at remains active and accessible, posing an active high-risk threat to users engaging with DeFi protocols. Immediate action is advised: block the domain and IP at the network perimeter and on endpoint systems. Users should verify target URLs via official Morpho Finance channels and disable suspicious browser extensions capable of injecting malicious scripts. Despite responsive blocking measures, residual risk persists due to delayed detection coverage; continuous monitoring and proactive threat hunting are required to fully neutralize this campaign.