morvexoptions[.]com

morvexoptions.com was observed delivering an HTTP 200 response with the page title “Welcome - Morvex Option Trades | Low Spread High Leverage CFD Stock & Commodities Online Broker”. The title suggests the site is masquerading as a CFD broker offering leveraged trading. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is served from the Cloudflare network (AS13335) at IP address 172.67.167.35, located in the United States. TLS termination is provided by Google Trust Services under the WE1 certificate, indicating a valid certificate chain but not necessarily legitimate ownership.

Infrastructure fingerprints show the site runs PHP on a Hostinger‑derived stack, uses Bootstrap for front‑end layout, integrates the Smartsupp live‑chat widget, and is delivered over HTTP/3 via Cloudflare. Reputation checks show the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans returned three positive detections out of ninety‑three vendor engines, confirming at least some security products consider the host malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the high‑risk assessment.

No additional public intelligence such as OTX or Google Safe Browsing entries were identified in the supplied data. The evidence points to a high‑confidence phishing operation targeting investors interested in CFD trading, but the specific lures, credential‑stealing pages, or payout infrastructure have not been captured in the current dataset. Defenders should block all traffic to the domain and its resolving IP, enforce outbound request filtering to Cloudflare‑hosted IP ranges hosting suspicious content, and monitor for any use of the identified technologies (PHP, Smartsupp, Hostinger) in conjunction with similar broker‑related page titles. Continuous re‑scanning on VirusTotal and inclusion in internal blocklists are recommended to capture any evolving malicious payloads.