morpho-finance[.]org

PhishDestroy identifies the domain morpho-finance.org as an active generic phishing threat currently under investigation, suspected to function as a cryptocurrency drainer. The threat classification aligns with malicious campaigns targeting financial assets through deceptive domains. As of the latest assessment, this domain remains unblocked by reputable security vendors and exhibits behavior consistent with active phishing operations, warranting heightened scrutiny from security researchers and end users.

This domain was flagged by 8 of 95 VirusTotal vendors, registered through GoDaddy.com, LLC, and resolves to IP address 172.67.161.58. The domain was created on April 26, 2026, and operates with a valid SSL certificate issued by Let’s Encrypt, which may contribute to its ability to evade early detection mechanisms. With no current detections on VirusTotal and no entries in public blocklists as of the seed timestamp (2bd480), this domain presents a low immediate signature-based detection rate despite its malicious intent.

Given the lack of third-party blocking and the absence of signature-based detection, users should treat this domain as hostile and avoid any interaction, including visiting the site or engaging with embedded wallet connection prompts. Security teams are advised to review network logs for outbound connections to 172.67.161.58 and to consider proactively blocking this IP and domain at the network perimeter. All cryptocurrency-related transactions should be suspended if exposure to this domain is suspected, and affected credentials or wallets should be audited and rotated immediately. Continuous monitoring is recommended due to the domain’s recent registration and rapidly evolving threat landscape.