orca[.]raydiun[.]pro

This domain, orca.raydiun.pro, is identified as a phishing site engaged in brand impersonation targeting users of the Raydium decentralized finance platform. The site presents itself as a legitimate Raydium staking portal, using the page title 'Raydium Staking' to deceive visitors into interacting with malicious smart contracts or disclosing sensitive wallet credentials. Such impersonation schemes are commonly used to facilitate unauthorized access to cryptocurrency wallets, leading to asset theft or compromise of private keys. The risk to users is elevated due to the convincing mimicry of the legitimate platform’s interface and functionality. Analysis indicates that the domain was registered on April 14, 2026, through NameCheap, Inc., a registrar frequently associated with newly created malicious domains. The domain resolves to the IP address 104.21.13.104, which is part of a content delivery network known for hosting both legitimate and malicious content. Detection metrics further confirm the domain’s malicious nature: 11 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on two independent security blocklists. Additional infrastructure analysis reveals the use of Cloudflare services, including HSTS and HTTP/3, which may be employed to obfuscate the true origin of the phishing content and evade detection. Users who visited orca.raydiun.pro should take immediate action to mitigate potential risks. First, disconnect any cryptocurrency wallets that were linked to the site and revoke any suspicious smart contract approvals using a trusted blockchain explorer. Next, monitor all connected accounts for unauthorized transactions and consider transferring assets to a new wallet if compromise is suspected. It is also recommended to scan the device used to access the site for malware or unauthorized software. Finally, report the domain to relevant security communities and blocklist providers to prevent further victimization.