morphosol[.]xyz

The domain morphosol.xyz was registered through ENOM, INC. on February 22, 2024. DNS resolution points to the IPv4 address 67.205.29.20, which belongs to AS26347 New Dream Network, LLC located in the United States. The authoritative name servers are ns1.dreamhost.com, ns2.dreamhost.com and ns3.dreamhost.com, indicating hosting on the DreamHost platform. HTTP responses are served by Nginx with the OpenResty module, and the site presents the page title “MORPHOGAME”.

An SSL certificate issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority – G2 chain is active, confirming the use of a publicly trusted certificate. Security telemetry assigns a Gridinsoft trust score of 0 out of 100, and the domain is listed on a single external blocklist. PhishDestroy has already taken the domain offline, and the current status is reported as taken offline. VirusTotal scans show that five of ninety‑five AV engines flagged the domain, reinforcing the suspicion of malicious activity. The threat profile is classified as a crypto scam that impersonates the brand “morpho”, as indicated by the “Brand target” field and the page title.

Observed indicators suggest a classic brand‑impersonation infrastructure: a recently created domain, low trust score, public TLS certificate, and hosting on a shared provider. However, no detailed payload, phishing landing page, or credential‑capture mechanism has been publicly disclosed, leaving the exact attack vector uncertain. Defenders should add 67.205.29.20 and the domain name to blocklists, monitor DNS queries for the DreamHost name servers, and enforce TLS inspection to detect any future use of the same certificate. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is recommended to capture any new detections. Organizations that reference the morpho brand should treat any communication from this domain as hostile and educate users about the impersonation attempt.