morraxis[.]app

This domain is flagged as an elevated-risk phishing infrastructure designed to impersonate legitimate software or web development portals. Analysis indicates the site mimics professional development services under the guise of "Morraxis App | Website/App/Wordpress Development," likely to harvest credentials, distribute malicious payloads, or solicit fraudulent payments from unsuspecting users seeking technical services. Infrastructure analysis reveals the domain morraxis.app was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 176.108.254.66 and is currently offline. The domain appears on one security blocklist and is flagged by 3 out of 95 security vendors on VirusTotal. Additional technical indicators include a Gridinsoft trust score of 0/100 and detected technologies such as Node.js, Ubuntu, React, Nginx, Next.js, and Webpack, suggesting a sophisticated frontend designed to appear legitimate. Mitigation steps for this threat type include blocking the domain and associated IP at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to newly registered domains impersonating development services. Users should be educated to verify the authenticity of development portals through official channels and avoid entering credentials or downloading files from unverified sources. Security teams are advised to monitor for related domains registered through the same registrar or resolving to the same IP range, as these may indicate further phishing campaigns.