votes-morpho[.]xyz

The domain votes-morpho.xyz was registered on February 26, 2026 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.96.3 located in the United States. DNS resolution points to the Cloudflare authoritative nameservers adam.ns.cloudflare.com and danica.ns.cloudflare.com, indicating the use of a content delivery network to obscure the true origin of the site. The site presents a page titled "Just a moment..." and does not serve an SSL certificate, meaning traffic is unencrypted and susceptible to interception.

Independent scanning on VirusTotal recorded five positive detections out of ninety‑three antivirus engines, confirming that multiple security products have identified the domain as malicious. Additionally, the domain is listed on two public blocklists and has been flagged by the PhishDestroy and ScamSniffer blocking services, reinforcing its classification as a phishing resource. The site’s current HTTP status is offline, suggesting the operators have taken the page down, either voluntarily or due to enforcement actions.

While the exact phishing lure (e.g., credential harvesting for a specific brand) cannot be confirmed from the available data, the combination of a generic page title, lack of TLS, and multiple vendor detections strongly indicates a generic credential‑stealing campaign. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules to include votes-morpho.xyz, and monitor the associated IP address for any re‑activation. Analysts should also watch for new domains registered by the same registrar or using the same Cloudflare IP range that may employ similar tactics.