23131[.]pages[.]dev

The domain 23131.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Raydium, a decentralized finance platform. This site was designed to deceive users into believing they were interacting with the legitimate Raydium interface, potentially leading to unauthorized access to accounts or financial loss. As of the latest verification, 23131.pages.dev has been taken offline, though it previously posed an elevated risk due to its fraudulent activity.

Technical analysis reveals that 23131.pages.dev was flagged by 1 of 95 security vendors on VirusTotal, including alphaMountain.ai, while Google Safe Browsing did not detect it. The domain appeared on three security blocklists: PhishDestroy, MetaMask, and SEAL. It was registered through Cloudflare, Inc. on March 22, 2026, and resolved to the IP address 188.114.96.3, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Swap Raydium'. The site employed technologies such as HSTS, Cloudflare, and HTTP/3, and currently returns an HTTP 403 status. Gridinsoft assigned it a trust score of 0/100.

Users who interacted with 23131.pages.dev should immediately change any credentials entered on the site, enable two-factor authentication, and monitor accounts for suspicious activity. If cryptocurrency transactions were attempted, revoke any token approvals and consider transferring funds to a new wallet. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand (Raydium) to assist in broader mitigation efforts.