users-morpho[.]xyz

users-morpho.xyz was first observed on March 13, 2026 and is currently listed as active with a high risk rating. The domain is registered through Dynadot LLC and resolves to the Cloudflare IP 188.114.97.3 (AS13335, United States). DNS resolution is provided by carter.ns.cloudflare.com and meiling.ns.cloudflare.com, confirming the use of Cloudflare’s edge network and HTTP/3 support. The site presents a 504 Gateway timeout page title, while the underlying HTTP response returns a 403 status code, indicating that the server is intentionally denying access to typical requests. The SSL certificate is issued by Let’s Encrypt (E8), confirming proper TLS deployment but offering no authentication beyond domain validation. Analysis identifies the domain as a brand impersonation targeting the financial services brand morpho. Reputation metrics are notably poor: Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records two positive detections from 95 scanned security vendors. The domain appears on three public blocklists and is already blocked by phishing mitigation services such as PhishDestroy, MetaMask, and SEAL. Defenders should add users-morpho.xyz to web‑filtering and email‑gateway block lists, monitor DNS queries for the domain and its Cloudflare name servers, and enforce strict verification of any communications that appear to originate from the morpho brand. Continuous observation of the IP address 188.114.97.3 and associated Cloudflare infrastructure is advised, as the attacker may reuse the same edge nodes for future impersonation campaigns.