ray-diun[.]xyz

The domain ray-diun.xyz was registered on April 20, 2026 through Dynadot Inc. It resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., placing the host in the United States. The site is secured with a Let’s Encrypt certificate (identifier YE2) and is served from Cloudflare nameservers celeste.ns.cloudflare.com and kareem.ns.cloudflare.com. Analysis of public threat feeds shows the domain is classified as a brand‑impersonation campaign targeting the Raydium platform. VirusTotal records indicate that 3 of 91 security vendors have flagged the domain, reinforcing the suspicion of malicious intent.

The domain appears on four external blocklists and is specifically blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. AlienVault OTX references the domain in a single threat‑intel pulse, providing additional corroboration of its malicious use. Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting an extremely low reputation.

The HTTP response currently returns a generic page title “Just a moment…”, and the site status is reported as offline, suggesting that the payload may no longer be active but the infrastructure remains observable. Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the associated IP and nameservers, and update detection rules to incorporate the observed vendor flags, blocklist entries, and the Let’s Encrypt certificate fingerprint. Ongoing vigilance is recommended because the underlying Cloudflare infrastructure could be repurposed for future impersonation attempts.