morpho[.]day

morpho.day is a live crypto wallet phishing domain actively luring users under the guise of a DeFi platform. morpho.day was flagged as a generic phishing host targeting Web3 users. The domain resolves to IP 75.2.60.5 and has earned a place on two independent security blocklists. VirusTotal currently returns 3 of 95 vendor detections. Registered on April 06, 2026 through Namecheap Inc., the site holds a valid Let's Encrypt certificate. Respected networks such as SEAL and MetaMask already block this domain, yet the lack of AV coverage underscores its evolving threat. Because the domain remains active and undetected by endpoint protection suites, users risk device compromise or cryptocurrency theft if credentials are entered. Until more blocklists and vendors flag the site, individuals should treat all links referencing morpho.day as hostile. Immediately cease interaction, purge any saved credentials associated with the domain, and report the URL to security teams. Consider disallowing traffic to 75.2.60.5 at the network perimeter while monitoring for certificate reuse or new subdomains under the same seed hash 4c368c.