raydiumn[.]lat

The domain raydiumn.lat was registered on March 22, 2026 through Dynadot LLC and is currently taken offline. DNS resolution points to the Cloudflare‑owned address 188.114.96.3, which resolves to a Cloudflare data centre in California, United States. The domain is served by Cloudflare infrastructure, as indicated by the authoritative nameservers adelaide.ns.cloudflare.com and agustin.ns.cloudflare.com, and it supports HTTP/3. An SSL certificate issued by Let’s Encrypt (certificate identifier E7) is present, confirming encrypted transport but offering no insight into the payload.

The page title returned from the site is "Swap Raydium," aligning with the declared brand target of Raydium and the classified scam type of a crypto scam. VirusTotal analysis recorded four positive detections out of ninety‑four scanned security vendors, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. The domain appears on three external security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple defensive platforms have identified it as a threat.

No additional content, login forms, or malicious payloads have been publicly disclosed, leaving the exact phishing mechanics uncertain. Defenders are advised to continue blocking the domain and its associated IP address, monitor for any re‑use of the Cloudflare nameservers, and incorporate the indicator set—including the domain name, IP, SSL fingerprint, and page title—into threat‑intel feeds. Ongoing observation of Cloudflare‑hosted IP ranges for similar brand‑impersonation patterns is recommended to mitigate potential re‑deployment of this infrastructure.