Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
morphobase.org shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 5 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 6 months oldMost scam domains are under a year old | Watch |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
| Hosted by | CLOUDFLARENETServer in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Overview
This website presents itself under the title "Morpho | The universal lending network" and operates as a single-domain web front end for what appears to be a decentralized-finance-style lending service. The visitor sees a text-heavy landing page that frames the platform as a universal lending network, an invitation to lend or borrow digital assets. The apparent business model is crypto-asset lending, an activity that normally involves connecting a wallet or committing funds.
Scam/Impersonation Risk
The site carries a confirmed blacklist-level reputational contradiction. Several independent threat-intelligence engines currently classify the domain as malicious, and a further engine rates it suspicious. These detections are corroborated by an external blacklist listing, so this is not an isolated or ambiguous flag. The domain was registered only about six months ago, yet its page title borrows the name and positioning of an established lending-network brand. A newly created domain using such a name, combined with active malicious classifications, is a pattern consistent with brand-borrowing infrastructure, even though no conflicting legal identities or direct impersonation of a named entity were observed in the supplied material. The site does not appear in any DeFi protocol directory, so nothing independent corroborates it as a recognized lending protocol. Browser behavior analysis shows a mixed picture. No wallet-drainer activity, clipboard manipulation, hidden forms, cloaking or credential posting to external hosts was observed, but most of the site's outbound background requests, including every external data submission, went to destinations outside the set of well-known services. For a lending front end, this undisclosed data flow is a material concern. Taken together, the platform should be treated as a high-risk destination for any financial or wallet interaction.
- Homepage: the page title presents the site as "Morpho | The universal lending network" on a domain registered on 2026-04-18 (about 6 months old) through Global Domain Group LLC.
- Reputation: 5 malicious and 1 suspicious detections from threat-intelligence engines, plus a corroborating external blacklist entry. The browser safe-browsing service did not flag the domain.
- Homepage behavior: 15 external background requests (12 to non-whitelisted destinations), 3 external POST submissions (all to non-whitelisted destinations) and 6 console errors across 3 successful runs. No wallet-connection, drainer, clipboard-hijack or hidden-form activity was recorded.
- Protocol recognition: the domain is not listed in the DeFi protocol directory used for cross-checking.
Regulatory Verification Notes
No licensing, registration or regulatory standing could be associated with the operator, and no independent regulator source corroborates the entity. The on-page disclosure position is unclear, so no named legal entity, licence reference or registered address anchors the lending activity the site advertises. Ownership details for the domain are incomplete, which is a form of ownership opacity rather than an identity contradiction. A lending service of this kind would ordinarily be expected to state who operates it and under what authority. Third-party broker-reputation datasets returned no match, so there is no broker-level reputational signal either way. Because the reputational contradictions above are independent of these disclosure points, the missing disclosures reinforce caution rather than stand alone as the concern.
- Legal and identity pages: no operating company, licence number or registry reference was established for the lending activity.
- Domain registration: the registrant details are incomplete, and the registration is about 6 months old (created 2026-04-18, expires 2027-04-18).
- Hosting: served from AS13335 (Cloudflare, Inc., US).
- Transport encryption: TLS certificate issued by WE1 with domain-validation (DV) only, valid to 2027-01-10. This confirms an encrypted connection but says nothing about who operates the site.
What to Verify Next
Before any interaction, the site's claimed connection to any established lending protocol should be tested against that protocol's officially published web address, obtained through an independent route such as the protocol's verified documentation or official social profiles, and not through links on this site. The operator should be asked to name a legal entity and licensing authority, and any answer should be checked in the relevant public registry. Official support and contact channels should be confirmed independently. Any wallet-signing prompt or approval request originating from this domain should be treated as untrusted until these checks are complete.
- Homepage: the lending-network branding is the claim to test against the official source of the brand it resembles.
- Legal and identity pages: no registry-checkable entity was identified.
- Threat intelligence: the active malicious classifications should be re-checked after any remediation claim.
Summary Verdict
The overall posture is critically low trust. The convergence of active malicious classifications from multiple independent sources and a newly created domain adopting an established lending brand's positioning outweighs the site's technically clean transport layer and stable page behavior. Legitimacy cannot be inferred, and the real-world operator is unconfirmed.
Infrastructure Integrity
The site sits behind a mainstream CDN and web application firewall, and the addresses observed are shared edge nodes with a clean abuse history. This is a mitigating factor for availability and abuse resilience only. Because only edge addresses are visible, the true hosting origin cannot be independently verified, and content could be swapped quickly behind the edge. Protective infrastructure therefore cannot offset the reputational findings and is not evidence of legitimacy.
Closing Assessment
At most, the site should be viewed read-only. No wallet should be connected, no transaction signed, no credentials entered, and no funds committed. Any interaction should wait until the threat listings are cleared and the operator is independently identified through official channels.
Written analysis generated 2026-10-27 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page exchanged network traffic with destinations TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_TRAFFIC - The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS - The page made background requests to destinations TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_XHR - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of morphobase.org.
- The request stayed on morphobase.org. It was not redirected to another domain. Clear
- Registration is published under Global Domain Group LLC. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-04-18. Noted
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Global Domain Group LLC |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3030::6815:48d1 |
| Name servers | ligia.ns.cloudflare.com, ryan.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2027-01-10 |
| Domain age | 0.52 years (continuous registration) |
| Domain expiry | 2027-04-18 |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 5 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about morphobase.org at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.