raydium-ai-official[.]web[.]app

This domain, raydium-ai-official.web.app, is identified as a brand impersonation threat targeting Raydium, a decentralized finance platform. Analysis indicates the site was designed to deceive users by mimicking Raydium’s branding and functionality, likely to facilitate unauthorized access to cryptocurrency assets or credentials. The page title, coins-raydium, further suggests an attempt to lure victims with the promise of cryptocurrency-related services or rewards. The domain is currently offline, though its prior activity remains a concern for potential victims and security teams. Infrastructure analysis reveals the domain was hosted through Google Firebase, resolving to the IP address 199.36.158.100. It employed SSL encryption via Google Trust Services, a common tactic to appear legitimate. The domain was flagged by 5 of 95 security vendors on VirusTotal, indicating moderate detection but sufficient concern to warrant blocking. It appears on one security blocklist and was actively blocked by at least one anti-phishing service. Technologies detected include Firebase hosting, HTTP Strict Transport Security (HSTS), and HTTP/3, which are consistent with modern web infrastructure but do not mitigate the underlying malicious intent. The domain is currently offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant for similar impersonation attempts, particularly those leveraging Firebase or other reputable hosting services to evade detection. Security teams are advised to monitor for domains with similar naming patterns (e.g., incorporating Raydium branding or cryptocurrency-related terms) and to review logs for interactions with 199.36.158.100. Users who may have engaged with this domain should assume credential compromise and take immediate steps to secure their accounts, including revoking access to associated wallets or applications. Proactive blocking of known malicious IPs and domains in network security controls is recommended to prevent future exposure.