DNS/CDN/frontend hash drift
Marinade Finance's assessment for RD-F-105 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
T-09 phase-2 signal (Tier-A). Applicable: marinade.finance is a live user-facing frontend with wallet connectivity. Current posture on official domain: no known DNS change or frontend hash drift on marinade.finance as of 2026-05-16. However, confirmed active phishing replica domains exist: staking-boost.com, stake-boost.com, rewards-marinade.finance -- all documented by PCRisk (last updated Dec 16 2025) as impersonating Marinade to steal seed phrases. These are separate domain registrations (distinct from DNS poisoning of the official domain), but represent an active threat ecosystem targeting Marinade users. Signal would not fire on official-domain monitoring today, but the phishing-replica pressure warrants yellow. Cat 11 RD-F-161 covers the typosquat angle directly.
Sources #
- URLPCRisk -- Marinade Staking Boost Scam (Dec 16 2025)https://www.pcrisk.com/removal-guides/33021-marinade-staking-boost-scamretrieved 2026-05-16
- Marinade Finance official homepage (no DNS anomaly detected)https://marinade.finance/retrieved 2026-05-16
Methodology #
Detect whether the hash of production frontend JS changes versus the prior published hash, or a DNS config change is detected.
See the full factor methodology and distribution across all protocols →