morphofi[.]lat

PhishDestroy identifies morphofi.lat as an active crypto drainer impersonating MetaMask, deployed to siphon cryptocurrency from unwitting users. The domain employs a generic phishing kit designed to mimic MetaMask’s login interface, tricking victims into entering wallet credentials or connecting compromised wallets to fraudulent smart contracts. The infrastructure appears lightweight but is optimized for quick deployment and evasion, leveraging free SSL certificates and bulletproof hosting to prolong operation. This domain resolves to IP 104.21.79.88 via Dynadot LLC, with a domain creation date of April 17, 2026—indicating recent registration and low historical trust. VirusTotal reports a detection score of 2/95 security vendors, while the domain is flagged on two global blocklists and blocked by SEAL and MetaMask’s internal defenses. The presence of a Let's Encrypt SSL certificate suggests an attempt to appear legitimate, though issuance occurred within hours of domain activation. As of today, morphofi.lat remains active despite active blocking by major security platforms. PhishDestroy continues to monitor and list this domain due to elevated drainer risk. Users are strongly advised to avoid this domain entirely, verify any crypto-related site via PhishDestroy’s live feed, and report suspicious activity to prevent fund loss. Remaining risk is high due to ongoing availability and potential for rebranding under new domains.