# PhishDestroy threat dossier — runmarine-services.com ================================================================ Fetched: 2026-06-21 08:04:30 UTC Canonical: https://phishdestroy.io/domain/runmarine-services.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 47/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: Forcepoint ThreatSeeker, Gridinsoft Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 Registrar: Name SRS AB Nameservers: ["dante.ns.cloudflare.com", "mimi.ns.cloudflare.com"] Registered: 2026-05-27 Expires: 2027-05-10 Page title: POLO88 - POLO 88: Perpustakaan Viral 123 Juta Followers HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-08-23 Status: INVALID chain Fingerprint: 5cfa24df8a7fc393b21fe3804072a9375e0e95f3a73f884e8099b368a00babe2 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-27 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-27 21:30:08 UTC (by PhishDestroy tracker) First reported: 2026-06-15 06:47:43 UTC (abuse notice filed) Last verified: 2026-06-21 08:20:35 UTC Neutralised: 2026-06-08 01:37:50 UTC Current status: taken down (registrar suspended or DNS dead) ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-18 16:49:44 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The runmarine-services.com domain has been identified as a credential theft threat, currently in an offline status, and was found to be impersonating the POLO88 brand. This domain was flagged by 2 of 95 VirusTotal vendors, indicating a potential risk to users who may have interacted with it. The domain was registered through Name SRS AB, resolves to the IP address 188.114.97.3, and was created on May 27, 2026, which is a relatively recent creation, adding to the suspicion. It also appears on 1 security blocklist, further solidifying its reputation as a potentially malicious entity. The technical indicators of this domain, including its Let's Encrypt SSL certificate, do not necessarily contribute to its malicious nature but do indicate an attempt to appear legitimate. Given these factors, it is crucial for users to exercise extreme caution when encountering such domains, especially those that have been flagged by security vendors and appear on blocklists. The fact that runmarine-services.com has been taken offline suggests that authorities or the registrar have taken action against it, but it is still essential for users to remain vigilant. PhishDestroy recommends that users who may have interacted with the runmarine-services.com domain or have provided any personal information to it should immediately take steps to protect themselves, such as changing passwords and monitoring their accounts for any suspicious activity. It is also advisable to avoid engaging with any websites that appear suspicious or have been flagged by security vendors, as these can pose significant risks to one's online safety and security. By staying informed and taking proactive measures, users can significantly reduce their risk of falling victim to credential theft and other online threats. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: d544c43cd724387ed77c02d6a5bfe382 TLS cert SHA-256: 5cfa24df8a7fc393b21fe3804072a9375e0e95f3a73f884e8099b368a00babe2 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/runmarine-services.com/ JSON API: https://api.destroy.tools/v1/check?domain=runmarine-services.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 167,188 domains (16,024 alive under monitoring, 150,846 confirmed takedowns/dead). Site: https://phishdestroy.io