app-morpho[.]lat

This domain, app-morpho.lat, is flagged as an active brand impersonation threat designed to deceive users of the Morpho platform. Analysis indicates the site mimics legitimate Morpho interfaces to harvest sensitive credentials, including login details and authentication tokens. Such impersonation schemes often lead to unauthorized account access, financial loss, or further exploitation through secondary attack vectors. The risk is classified as elevated due to the domain's targeted nature and the potential for significant user impact. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on February 21, 2026, through Dynadot LLC, a registrar frequently associated with abusive registrations. It resolves to the IP address 104.21.25.235, which has been linked to other suspicious domains in recent threat intelligence reports. Detection metrics further validate the threat: 10 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two independent security blocklists. Additionally, the page title 'Just a moment...' is a common evasion technique used to delay or obscure malicious activity from automated scanners. Users who visited app-morpho.lat should take immediate action to mitigate potential risks. First, terminate any active sessions on the site and avoid entering credentials or personal information. If credentials were already submitted, reset passwords for Morpho and any associated accounts, prioritizing those using the same or similar passwords. Enable multi-factor authentication where available to add an additional security layer. Monitor accounts for unauthorized transactions or changes, and review connected devices or sessions for signs of compromise. Finally, report the incident to the legitimate Morpho security team to assist in broader threat mitigation efforts.