morpho[.]airdropsalert[.]us

This domain, morpho.airdropsalert.us, was observed targeting the Google brand through a crypto‑scam campaign. The site was registered on 18 October 2025 via Dynadot LLC and resolves to the IP address 142.250.190.228, which belongs to AS15169 Google LLC located in the United States. DNS resolution is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No HTTPS certificate was presented; the connection was HTTP‑only, indicating a lack of transport‑layer security. The page title returned by the server is “Google”, matching the declared brand target.

Security monitoring shows the domain is currently offline and has been taken down. It is listed on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal analysis recorded 13 detections out of 93 scanned vendors, confirming malicious behavior. Gridinsoft assigned a trust score of 0 / 100, reinforcing the classification as a high‑risk artifact. The domain is categorized as a crypto scam in the intelligence feed.

Available evidence confirms the impersonation of Google and the use of a reputable hosting ASN, which may be intended to lend credibility. However, the lack of an SSL certificate and the isolated blocklist entry suggest limited distribution. No additional indicators such as Safe Browsing alerts, OTX references, or malware payload hashes are currently available. Defenders should ensure that any outbound connections to 142.250.190.228 are denied or monitored, update URL filtering policies to block morpho.airdropsalert.us, and add the domain to internal blocklists. Continuous monitoring of Cloudflare name‑server activity and future VirusTotal submissions is advised to detect any re‑use of the infrastructure.