morplho[.]at

PhishDestroy identifies morplho.at as an active credential theft domain impersonating a login portal to harvest user credentials. This domain (registered via Hosting Concepts B.V./Registrar.eu) resolves to IP 188.114.97.3 and utilizes a Google Trust Services SSL certificate to appear legitimate. Security vendor analysis shows alarmingly low detection rates with only 1 out of 95 engines flagging this threat—indicating either a very new campaign or deliberate evasion tactics. This domain was flagged by PhishDestroy with an elevated risk level due to its generic phishing nature. Technical indicators reveal registration through a Netherlands-based registrar (ID 648) with infrastructure hosted on Cloudflare IP space. The SSL certificate (issued by Google Trust Services) adds a false veneer of legitimacy, though the domain itself shows minimal security coverage in VirusTotal’s detection matrix. Current threat intelligence suggests this may be part of a broader credential harvesting operation targeting unsuspecting users. Users who visited morplho.at should immediately check their accounts for unauthorized access, especially if credentials were entered. Disconnect from the site without interacting further, then clear browser cache/cookies. Report the domain to your security team or through platforms like PhishDestroy’s threat feed to aid in broader mitigation efforts. Avoid all future access to this domain—its single VirusTotal detection suggests widespread blind spots in automated defenses.