7zzb6542zn[.]raydiumpro[.]vip

This domain, 7zzb6542zn.raydiumpro.vip, is flagged as an active high-risk phishing site impersonating Raydium, a known cryptocurrency platform. Registered on October 4, 2025, through Gname.com Pte. Ltd., the domain remains operational as of July 12, 2026, and resolves to IPv6 address 2606:4700:3032::6815:5df1, protected by Cloudflare infrastructure. The site uses HTTP/3 and is secured with a Let's Encrypt SSL certificate, a common tactic to appear legitimate. The page title, 'Raydium Pro,' directly references the targeted brand, reinforcing the impersonation attempt. Analysis indicates the domain is detected by 13 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. The Gridinsoft trust score of 0/100 further supports its malicious classification. No evidence of a phishing kit or additional infrastructure details is currently available, but the combination of brand impersonation, recent registration, and low detection thresholds suggests a deliberate attempt to deceive users. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency or Raydium-related services are accessed. Monitoring for related domains using similar naming patterns (e.g., 'raydiumpro' variants) is recommended, as this may indicate a broader campaign. The domain's use of Cloudflare complicates takedown efforts, so coordination with the registrar and hosting provider may be necessary for mitigation.