morpho[.]airdrpsalerts[.]lat

Analysis of morpho.airdrpsalerts.lat indicates that the domain was deliberately registered to impersonate Google, as reflected by the page title "Google" and the explicit branding target. The domain was created on October 29, 2025 and is registered through Dynadot LLC. DNS resolution points to the IPv4 address 142.250.184.196, which belongs to AS15169 owned by Google LLC and is located in the United States. The hosting infrastructure therefore appears to leverage a legitimate Google IP range, a tactic that can increase trustworthiness in automated filters. No TLS certificate is presented, leaving the site without encryption.

VirusTotal records show that eight of ninety‑five scanners flagged the domain, suggesting that a minority of security products identified malicious characteristics. The site has been blocked by PhishDestroy and appears on one additional security blocklist, reinforcing the consensus that it is abusive. Current network probes report the domain as taken offline, limiting immediate observation of payload delivery or page content.

Defenders should continue to block the domain at DNS and proxy layers, add it to internal threat feeds, and monitor for any re‑use of the same name or similar sub‑domains. Because the domain resolves to a Google‑owned IP, further scrutiny of adjacent IP ranges for similar abuse is advisable. Ongoing vigilance is required to detect potential re‑registration or fast‑flux techniques that could resurrect the impersonation campaign.