morpho[.]airsdropalert[.]click

morpho.airsdropalert.click is a subdomain of airsdropalert.click. PhishDestroy first recorded this hostname on Nov 8, 2025. Stored content metadata identifies Gmail as the apparent target. The captured page title is “Google”. Content analysis also recorded brand signals for Google. The stored content classification is credential phishing. The evidence score is 91/100 (critical).

One evidence source is positive: VirusTotal. VirusTotal recorded 12 detections among 95 engines: ADMINUSLabs, ChainPatrol, BitDefender, CRDF, CyRadar, ESET, Fortinet, G-Data, Lionic, Seclookup, Sophos, Webroot on Jul 18, 2026 at 18:45 UTC. Other stored checks provide context: The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:24 UTC. URLScan completed without a malicious verdict on Mar 2, 2026 at 01:15 UTC.

HTTP 502 server error was recorded on Aug 7, 2026 at 10:20 UTC. Registration records for the registrable domain airsdropalert.click list Dynadot LLC as the registrar and Nov 5, 2025 as the creation date. Registration preceded first observation by 3 days. At collection time, the hostname resolved to 142.250.185.100 on AS15169 (GOOGLE, US). The associated network metadata labels the endpoint as AS15169 Google LLC in Mountain View, US. The stored server header is gws. DOM analysis completed on Mar 11, 2026 at 09:23 UTC; stored DOM score 25/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:43 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists WE1 as the certificate issuer with validity through Jun 1, 2026; checked Mar 11, 2026 at 12:47 UTC.

The stored third-party corroboration is limited to VirusTotal; the report preserves that positive result without claiming agreement across multiple source families.