morpho[.]stakingreward[.]app

Analysis of morpho.stakingreward.app indicates a brand impersonation campaign targeting Google. The domain was registered on December 27, 2025, through Dynadot LLC and currently resolves to IP 142.251.221.68, which geolocates to India under AS15169 (Google LLC). Despite the IP association with Google, infrastructure analysis reveals the domain uses Cloudflare nameservers (alexa.ns.cloudflare.com and randall.ns.cloudflare.com), a common tactic to obscure hosting details and evade detection. No SSL certificate was observed, increasing the likelihood of interception or manipulation of unencrypted traffic.

The page title 'Google' aligns with the reported brand target, suggesting an intent to deceive users into believing the site is legitimate. Detection data from July 23, 2026, shows 17 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist, with PhishDestroy explicitly blocking it. The domain is currently offline, which may indicate takedown action or temporary suspension by the threat actor.

Defenders should treat this domain as high-risk due to its confirmed impersonation of a major brand, lack of encryption, and detection by multiple security vendors. Network-level blocking is recommended, particularly for organizations where Google services are critical. Further investigation into the registration details and historical DNS records may reveal additional infrastructure or affiliated domains used in this campaign.