morpho[.]airdrpsalerts[.]click

The domain morpho.airdrpsalerts.click was registered on November 04, 2025 through Dynadot LLC and is currently listed as offline. DNS resolution points to the IP address 142.250.65.228, which belongs to AS15169 Google LLC and is geolocated in the United States. Despite the legitimate hosting attribution, the domain resolves to a Google-owned IP while serving a page titled "Google," indicating an attempt to masquerade as the Google brand. No SSL certificate was observed for the host, leaving the HTTPS handshake unencrypted and exposing potential downgrade attacks.

The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both under Cloudflare's infrastructure, a pattern often used by malicious operators to leverage reputable DNS services. The domain appears on one known security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal analysis returned 16 positive detections out of 95 scanned vendors, confirming that multiple security engines have flagged the domain as malicious.

The combination of brand impersonation, use of a reputable IP range, lack of TLS, and multiple vendor detections suggests a purposeful campaign to deceive users seeking Google services. Defenders should ensure that DNS filtering solutions block both the domain and its associated IP, incorporate the host into endpoint allow‑list exceptions, and monitor for newly registered subdomains that resolve to the same IP range. Continuous reconnaissance of Cloudflare‑hosted nameservers is recommended to detect similar impersonation attempts, and any observed traffic to morpho.airdrpsalerts.click should be logged and investigated for potential credential harvesting or malware delivery.