marinade[.]today

PhishDestroy identifies marinade.today as an active brand impersonation phishing domain targeting Marinade.fi users. This domain mimics the legitimate brand marinade.finance to deceive visitors into disclosing sensitive information such as wallet credentials or private keys. The threat actor registered the domain on June 13, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar commonly abused in phishing operations. VirusTotal analysis confirms 2 out of 95 security vendors flag this domain, indicating low but present detection coverage, while the domain resolves to IP address 188.114.96.3. The use of a Let's Encrypt SSL certificate adds superficial legitimacy, increasing the risk of successful deception among non-technical users. This domain was flagged for active brand impersonation targeting the Marinade ecosystem, a liquid staking protocol on Solana. The domain marinade.today was created on June 13, 2025, just days before the current investigation. Security telemetry shows minimal vendor detection (2/95), suggesting the campaign is either newly deployed or leveraging subtle obfuscation techniques. The IP address 188.114.96.3 has been associated with multiple low-reputation activities, including hosting of phishing lures and fake DeFi interfaces. While not yet widely blocked, the combination of recent registration, impersonation tactics, and hosting on a bulletproof-friendly IP elevates the risk to elevated status. Users who visited marinade.today should immediately check their browser history and wallet extensions for unauthorized connections. If any sensitive data such as seed phrases or private keys were entered, transfer all funds to a new wallet immediately and revoke any unauthorized approvals using tools like Solscan or Debank. Clear browser cache and cookies, then run a malware scan. Report the domain to your antivirus vendor, browser provider, and the Marinade security team via their official channels. Avoid visiting any similar domains without verifying the correct URL (marinade.finance) and ensuring HTTPS with a valid certificate issued to the legitimate domain.