marina-protocol[.]xyz

Analysis of marina-protocol.xyz shows a newly registered domain created on 31 October 2025 that is being used to impersonate Google in a wallet‑seed phishing campaign. The site resolves to the Cloudflare‑owned address 188.114.97.3, which is announced by AS13335 and geolocated to the United States. No TLS certificate is presented, indicating that the site does not encrypt traffic and further confirms its illicit nature. The authoritative name servers are louis.ns.cloudflare.com and veronica.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure, a common choice for fast‑deployment malicious sites.

The registrar listed is NiceNIC International Group Co., Limited. VirusTotal records indicate that three of ninety‑five scanning engines have flagged the domain as malicious, providing independent vendor corroboration of its threat posture. Gridinsoft’s trust score for the domain is 0 out of 100, reinforcing the high‑risk assessment. The page title returned from the HTTP response is “Marina Protocol,” which does not correspond to the advertised Google‑related service and suggests a generic landing page used for credential harvesting.

The domain appears on two public blocklists – PhishDestroy and ScamSniffer – confirming that security‑focused feed providers have already taken action to block the host. Current network scans show the site is offline, which may be a temporary takedown or a tactic to evade detection; however, the underlying infrastructure remains reachable. Given the combination of a brand‑targeted impersonation (Google), a wallet/seed phishing payload, low trust metrics, and multiple vendor detections, defenders should continue to block the domain at perimeter devices, update URL filtering rules, and monitor for any re‑use of the associated IP address or name‑server configuration. Incident responders should also inspect any logs for outbound connections to 188.114.97.