raydium-rectify[.]xyz

raydium-rectify.xyz was registered on 29 September 2025 through OwnRegistrar, Inc. The domain resolves to 172.67.213.82, an address owned by AS13335 Cloudflare, Inc. and located in the United States. DNS resolution uses the Cloudflare authoritative name servers greg.ns.cloudflare.com and marjory.ns.cloudflare.com, and the site presents a TLS certificate issued by Google Trust Services under the WE1 root. The web server returns HTTP 403 for the default request and advertises HTTP/3 support, indicating modern CDN configuration. The page title observed is “Nur einen Moment…”, a German phrase meaning “Just a moment…”, but no further content has been disclosed. MX configuration includes a single record with priority 0 pointing to “_dc-mx.f02e1ec060d2.raydium-rectify.xyz”, suggesting a custom mail routing setup.

The domain is classified as a high‑risk brand‑impersonation campaign targeting the Raydium cryptocurrency platform, and the scam type is listed as “Crypto Scam”. Threat intelligence aggregators have flagged the domain on one public blocklist, specifically PhishDestroy, and the domain appears on a single security blocklist overall. VirusTotal analysis shows that 11 of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment. Reputation services assign a Gridinsoft trust score of 0 / 100, indicating a lack of trust. While the observed HTTP 403 response prevents immediate content retrieval, the combination of a legitimate‑looking SSL certificate, Cloudflare hosting, and the German‑language title suggests an attempt to gain credibility before delivering a malicious payload.

The presence of a custom MX record may be used for phishing‑related email campaigns. At present, no additional indicators such as malicious payload hashes, command‑and‑control endpoints, or victim interaction logs have been released, leaving the exact attack vector uncertain. Defenders should block any outbound connections to 172.67.213.82 and add raydium-rectify.