royalmarinetransport[.]com

Analysis as of July 28, 2026 indicates that the domain royalmarinetransport.com is currently active and has been observed in a generic phishing campaign. The site returns an HTTP 301 redirect, suggesting that the original page is being forwarded to another location, a technique often used to evade initial detection. DNS resolution points to the IP address 188.114.96.3, which is hosted by Cloudflare infrastructure as indicated by the authoritative name servers marlowe.ns.cloudflare.com and santino.ns.cloudflare.com. The domain is registered through Atak Domain Bilgi Teknolojileri A.S., a registrar based in Turkey, which does not inherently convey malicious intent but provides a traceable registration record. VirusTotal reports show that the domain was scanned by 91 antivirus and URL scanning vendors, none of which raised a detection at the time of analysis.

While the lack of a detection does not confirm safety, it demonstrates that the domain has not yet been flagged by automated scanning services. The domain is listed on a single public security blocklist and has been actively blocked by the PhishDestroy service, indicating that at least one anti‑phishing community has identified it as malicious. No additional blocklists or reputation services are currently enumerating the domain. The page title retrieved from the live host is “Royal Marine Transport – Logistics, Shipping, Handling,” which mimics a legitimate logistics provider and may be intended to lure victims into providing credentials or personal information. No SSL certificate details, Safe Browsing status, or Open Threat Exchange (OTX) entries were found in the available data, leaving those vectors unconfirmed.

Given the observed infrastructure, the presence on a blocklist, and the deceptive page title, defenders should treat royalmarinetransport.com as a high‑risk indicator.