morpho[.]airdrpsalert[.]lat

Analysis indicates that the domain morpho.airdrpsalert.lat was registered on October 26, 2025 through Dynadot LLC and is currently flagged as a brand‑impersonation site targeting Google. The page title returned by the server is “Google”, confirming that the domain presents itself as the legitimate brand. DNS resolution points to the IP address 142.250.184.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The use of infrastructure owned by Google for a malicious impersonation campaign is a notable tactic that can increase the perceived legitimacy of the site. The domain is served without an SSL/TLS certificate, which is consistent with the offline status reported at the time of analysis.

Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com are authoritative, indicating reliance on a popular CDN provider for DNS handling. Detection data shows that two of ninety‑five VirusTotal scanners have raised flags on the domain, and it appears on one external blocklist. The phishing‑specific blocklist PhishDestroy has already added the domain to its denylist, providing an immediate mitigation vector for organizations that ingest that feed. No additional public threat‑intel platforms are cited in the available data, and the limited number of vendor detections suggests that the payload or page content has not been widely observed.

Because the site is presently offline, active content cannot be examined, and the absence of an SSL certificate prevents transport‑layer fingerprinting. Defenders should block the domain at the DNS layer, add the IP address 142.250.184.196 to network‑level deny lists where appropriate, and ingest the PhishDestroy feed to ensure automatic containment. Continuous monitoring of the registrant’s WHOIS record and of the Cloudflare nameservers is advised, as the adversary may reactivate the domain or launch new impersonation sites using the same infrastructure.