app-marinade[.]xyz

The domain app-marinade.xyz was registered on 23 February 2026 through Dynadot LLC and resolves to the Cloudflare address 104.21.1.7, which is associated with AS13335 Cloudflare, Inc. and located in the United States. The site served an SSL certificate issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS connection. When accessed, the server responded with HTTP status 404 and the page title “Marinade: Native & Liquid Solana Staking for Leading Rewards,” suggesting an attempt to masquerade as a Solana‑related staking service.

The threat intelligence record classifies the activity as a crypto scam that impersonates the Solana brand. The domain appears on four independent blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, and has been flagged by one of ninety‑three VirusTotal security vendors. Technical fingerprints show the use of Cloudflare’s edge network and HTTP/3 protocol.

As of the report date, the site is taken offline, but the infrastructure remains observable. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts using the same IP or certificate, and update endpoint protection rules to reflect the observed malicious indicator. Because the site is currently inactive, further content analysis is not possible, and any future reappearance should be re‑evaluated for additional malicious behavior.