raydium-sols[.]pages[.]dev

The domain raydium-sols.pages.dev is a phishing site engaged in brand impersonation targeting Raydium, a decentralized finance platform. It poses as a legitimate Raydium service to deceive users into disclosing sensitive information or interacting with malicious smart contracts. No crypto drainer kit was identified in this case. The site is currently taken offline, but its prior activity remains a confirmed threat.

Technical indicators show raydium-sols.pages.dev was registered through Cloudflare, Inc. on February 21, 2026, with nameservers daisy.ns.cloudflare.com and derek.ns.cloudflare.com. It resolved to IP address 188.114.96.3, hosted on Cloudflare's US network (AS13335). The SSL certificate was issued by Google Trust Services / WE1, and the site employed HSTS and HTTP/3 technologies. At the time of analysis, 0 of 95 VirusTotal vendors flagged the domain, though it appeared on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. The observed HTTP status was 500, with the page title 'Worker threw exception | raydium-sols.pages.dev | Cloudflare'.

Users who interacted with raydium-sols.pages.dev should immediately change any credentials entered on the site and enable two-factor authentication on all related accounts. Monitor financial and transactional activity for unauthorized access or fraud. If crypto assets were exposed, revoke any token approvals granted to unknown contracts using a wallet manager like Revoke.cash. Report the domain to Google Safe Browsing, PhishTank, and the impersonated brand (Raydium) to aid in takedown efforts. Victims may also file complaints with local cybercrime units or platforms like IC3.gov.