morpho[.]airsdropsalert[.]lol

The domain morpho.airsdropsalert.lol is flagged for brand impersonation targeting Google. Infrastructure analysis shows the domain resolves to IP address 142.250.74.196, which belongs to AS15169 owned by Google LLC and is located in the United States. The domain uses Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and was registered through Dynadot LLC on November 5, 2025. No TLS certificate is presented, indicating the site operates without HTTPS protection.

The page title returned by the HTTP response is "Google," matching the declared brand target. Threat intelligence sources list the domain on a single security blocklist and note that PhishDestroy has actively blocked it. VirusTotal scans report seven detections out of ninety‑five participating vendors, confirming malicious classification by multiple independent scanners.

The domain is currently taken offline, but historical activity suggests it was used to lure victims by exploiting the trusted Google brand. Defenders should continue to deny network traffic to 142.250.74.196 when associated with this hostname, add the domain to internal blocklists, and monitor for new registrations that reuse the same naming pattern or Cloudflare name servers. Ongoing vigilance is recommended because the lack of SSL and the use of a legitimate Google IP can bypass naïve trust heuristics, increasing the risk of successful impersonation campaigns.