marinade-web-67n[.]pages[.]dev

PhishDestroy identifies marinade-web-67n.pages.dev as an active brand impersonation campaign targeting Marinade users. This Cloudflare Pages subdomain resolves to 172.66.44.83 and uses a Google Trust Services SSL certificate to enhance credibility. The domain is unflagged on VirusTotal with 0 detections out of 95 scanners, indicating a low immediate detection rate despite active malicious intent. Creation details remain under investigation, but the absence of blocklist entries suggests a recently deployed threat actor infrastructure.

This domain specifically masquerades as Marinade’s official web interface to deceive users into connecting cryptocurrency wallets under the guise of staking or governance participation. Victims who interact with the fraudulent login or wallet-connect prompts risk unauthorized transaction approvals and asset drainage to attacker-controlled addresses. The use of Cloudflare’s infrastructure and a legitimate SSL certificate obscures the malicious nature, making it harder for endpoint detection and response systems to flag the activity in real time.

Users who visited marinade-web-67n.pages.dev should immediately revoke any active wallet connections via their wallet’s connection management interface. Disconnect the domain from connected applications and inspect transaction history for unauthorized approvals. If any interaction occurred, transfer remaining assets to a new wallet with updated security settings. Report the domain and any suspicious transactions to PhishDestroy for further investigation and consider enabling hardware wallet signing for future transactions to mitigate remote exploitation risks.