raydium-claim[.]click

The domain raydium-claim.click was registered on February 21, 2026 through Global Domain Group LLC. It resolves to 172.67.145.83, an address owned by Cloudflare (AS13335) located in the United States. The site is protected by Cloudflare’s edge services and serves content over HTTP/3 using a TLS certificate issued by Google Trust Services (subject WE1). An HTTP 403 response is returned, and the page title reported by scanners is the Japanese phrase “しばらくお待ちください...”, which translates to “please wait a moment”. The domain is classified as a crypto‑scam that impersonates the legitimate Raydium platform. VirusTotal records show that 17 of 93 scanning engines flagged the domain as malicious.

It appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX lists the domain in a single threat‑intelligence pulse. The nameservers amy.ns.cloudflare.com and kai.ns.cloudflare.com confirm the use of Cloudflare DNS. Current operational status is offline, as indicated by the 403 response and the “taken offline” note in the intelligence feed.

Evidence confirms that the domain is being used to lure victims into a Raydium‑related cryptocurrency fraud, but the exact payload or credential‑harvesting mechanism has not been captured, leaving the precise attack vector uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address or associated Cloudflare nameservers, and update endpoint and browser protection rules to reflect the 17 VirusTotal detections. Threat‑intel consumers should also add the domain to internal watchlists, correlate any outbound connections to 172.67.145.83 with user activity, and verify that any wallet‑related extensions such as MetaMask are configured to reject interactions with this domain.