ray-dium[.]lat

This domain, ray-dium.lat, operates as a confirmed brand impersonation scam specifically targeting users of the Raydium decentralized exchange. Analysis indicates the site mimics Raydium's legitimate staking interface, presenting a fraudulent "Raydium Staking" portal designed to deceive victims into connecting cryptocurrency wallets. The threat actor likely employs wallet-draining techniques to siphon digital assets once users authorize transactions through the malicious interface, a common tactic in crypto-focused phishing operations.

Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on December 11, 2025, through Dynadot LLC, a registrar frequently observed in phishing campaigns. It resolves to the IP address 172.67.159.29, which has been associated with other fraudulent domains. Security vendors have flagged the domain, with VirusTotal reporting 2 detections out of 95 engines. Additionally, the domain appears on two distinct security blocklists, further corroborating its malicious classification. The combination of recent registration, brand impersonation, and limited but confirmed detections suggests a targeted operation with elevated risk.

Users who visited ray-dium.lat or interacted with its content should immediately revoke any wallet permissions granted to the site. All connected wallets should be audited for unauthorized transactions, particularly those involving token approvals or asset transfers. If funds were lost, victims should report the incident to relevant blockchain analytics platforms and law enforcement agencies specializing in cryptocurrency fraud. To prevent future exposure, users are advised to verify domain authenticity through official project channels before connecting wallets or entering sensitive information.