morphovotes[.]xyz

The domain morphovotes.xyz is identified as a cryptocurrency phishing operation targeting digital wallet credentials. Analysis confirms this domain as an active threat under the generic_phishing category, currently marked offline. No specific brand impersonation has been confirmed, though the infrastructure aligns with common cryptocurrency credential harvesting tactics. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 12, 2026, an atypical future date suggesting potential registration data manipulation. It resolves to IP address 104.21.62.90 and holds a Gridinsoft trust score of 0/100. Security vendors on VirusTotal flagged the domain at a rate of 2/95, while it appears on three distinct security blocklists. Additional blocking actions have been implemented by MetaMask, PhishDestroy, and SEAL, indicating broad recognition of its malicious intent. Current status shows the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to implement immediate network-level blocking of the domain and its associated IP address. Endpoint protection systems should be updated to include morphovotes.xyz in phishing filters. Users who accessed the domain should rotate all cryptocurrency wallet credentials and monitor for unauthorized transactions. Given the elevated risk level and cryptocurrency targeting, enhanced vigilance is recommended for all digital asset management systems.