morpho[.]airdropsalert[.]icu

Analysis of morpho.airdropsalert.icu indicates a brand‑impersonation campaign targeting Google users with a fake‑airdrop lure. The domain was registered through Dynadot LLC on 17 October 2025 and resolves to 142.250.185.100, an address owned by AS15169 Google LLC located in the United States. Hosting under Google’s infrastructure is a common tactic to increase perceived legitimacy. The domain uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was observed at the time of collection, suggesting the site was served over plain HTTP.

The page title returned “Google”, matching the brand target supplied in the intelligence. VirusTotal recorded 13 detections out of 95 scanners, indicating a modest but non‑trivial consensus among security vendors that the site is malicious. The domain appears on a single public blocklist and has been added to the PhishDestroy feed, confirming that threat‑intel providers have already taken defensive action. Current HTTP status shows the site is offline, which may be temporary or part of takedown efforts.

Uncertainty remains regarding the exact content delivered to victims, as no payload or credential‑harvesting page could be captured. Defenders should block the domain and its resolve IP at the network perimeter, monitor DNS queries for the associated Cloudflare name servers, and add the domain to internal URL filtering lists. Continuous re‑scanning is advised in case the infrastructure is re‑hosted or the site is revived under a new certificate.