ray-dium[.]cam

Analysis of ray-dium.cam shows that the domain was registered on 21 February 2026 and currently resolves to the Cloudflare address 104.21.33.6, which is geolocated in the United States under ASN 13335. The site presented the page title “Raydium Staking”, indicating an attempt to lure victims into a wallet or seed‑phishing flow targeting the Raydium brand and potentially other assets described as “across”. The SSL certificate is identified only as “WE1”, providing no additional validation of legitimacy. Automated scanning on VirusTotal recorded 2 detections out of 93 security vendors, confirming that at least a minority of scanners flag the domain as malicious.

The domain appears on two independent blocklists—PhishDestroy and ScamSniffer—both of which classify it as a wallet/seed phishing site. A Gridinsoft trust score of 0 / 100 further reinforces the malicious assessment. The current operational status is reported as offline, which may be a temporary takedown or an evasion tactic. While the observed indicators strongly support a brand‑impersonation and credential‑harvesting campaign, the lack of publicly released payload samples or detailed page content limits a full attribution of the phishing kit used.

Defenders should continue to block the domain at network perimeter, add the IP address 104.21.33.6 to deny‑list rules, and monitor for any re‑hosting attempts on other Cloudflare nodes. Continuous re‑scanning with multi‑vendor services is advised to capture potential changes in detection ratios. Incident response teams should also advise users of Raydium‑related services to verify URLs before entering seed phrases and to treat any unsolicited staking prompts as suspicious.