raydium-gains[.]io

The domain raydium-gains.io was registered on September 11, 2025 through NiceNIC International Group Co., Limited and remains active as of the report date. DNS resolution points to the Cloudflare‑owned address 172.67.166.117, with authoritative name servers miki.ns.cloudflare.com and steven.ns.cloudflare.com. The site presents an SSL certificate issued by Google Trust Services under the WE1 intermediate, indicating HTTPS is enabled. Network fingerprinting shows the IP belongs to AS13335 Cloudflare, Inc., located in the United States. HTTP probing returns a 403 status code, suggesting access restrictions or a protective block. Threat intelligence flags the domain as a cryptocurrency‑related impersonation of the Raydium brand. VirusTotal analysis records 5 detections out of 95 scanners, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. The only visible page title is “Just a moment…”, and no further content has been captured, leaving the exact malicious payload or lure undefined. The presence of Cloudflare Browser Insights, Cloudflare services, and HTTP/3 indicates the operator is leveraging modern CDN features, possibly to evade simple signature‑based detection. While the technical indicators confirm malicious intent, the specific phishing flow—such as credential capture or wallet address substitution—remains unverified. Defenders should add raydium-gains.io to domain blocklists at network and endpoint layers, and monitor DNS queries for this host. Email gateways should flag any messages containing links to the domain, especially those referencing Raydium or cryptocurrency transactions. Incident response teams should treat any traffic to the IP as suspicious, enforce TLS inspection to capture potential payloads, and consider reporting the domain to additional threat sharing platforms to broaden coverage.