app-marinade[.]org

The domain app-marinade.org was registered on April 04, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and immediately pointed at Cloudflare’s network. The authoritative name servers are adelaide.ns.cloudflare.com and cosmin.ns.cloudflare.com, both belonging to Cloudflare, Inc. DNS resolution returns the IPv4 address 188.114.97.3, which is geolocated to Canada and associated with Cloudflare’s edge infrastructure. The site presents a Let's Encrypt certificate (issuer E8), indicating the presence of TLS but offering no evidence of a legitimate certificate chain beyond the free CA. Gridinsoft’s trust scoring assigns a rating of 0 out of 100, and the domain appears on a single public blocklist.

Threat intelligence correlates the domain with a brand‑impersonation campaign targeting the Marinade brand. AlienVault OTX lists the domain in eight distinct pulses, and PhishDestroy has already added it to its blocklist. VirusTotal analysis shows that two out of ninety‑five security scanners flagged the domain, suggesting at least partial malicious behavior. An HTTP request to the root URL returns a 403 status code, which may indicate a deliberately restricted landing page or a protective response from the hosting provider. The domain remains active as of the report date.

Defenders should assume the domain is being used to harvest credentials or distribute malicious payloads under the guise of Marinade. Immediate mitigation steps include adding 188.114.97.3 to outbound deny lists, enforcing URL filtering for any sub‑domain of app‑marinade.org, and monitoring DNS queries for the associated Cloudflare name servers. Since the actual page content has not been publicly analyzed, further investigation—such as sandboxing any retrieved pages and inspecting TLS handshake details—is recommended to confirm the payload type. Continuous feed updates from PhishDestroy, AlienVault OTX, and VirusTotal will help maintain situational awareness.