raydium[.]firebid[.]xyz

Analysis of the domain raydium.firebid.xyz indicates it was actively involved in a wallet seed phishing campaign targeting users of the Raydium decentralized exchange. The domain, registered on April 11, 2025, through Go Daddy, LLC, resolved to the IP address 54.192.51.87, hosted under Amazon.com, Inc. (AS16509) in the United States. Infrastructure analysis reveals the use of AWS nameservers, specifically ns-1141.awsdns-14.org, ns-1977.awsdns-55.co.uk, ns-229.awsdns-28.com, and ns-652.awsdns, which is consistent with cloud-based phishing operations. The domain lacked an SSL certificate, increasing the likelihood of interception of sensitive data transmitted to the site.

The page title, 'Swap Raydium,' directly aligns with the identified scam type of wallet or seed phishing, suggesting the site was designed to deceive users into entering cryptocurrency wallet credentials or recovery phrases. As of the report date, the domain has been taken offline, though its prior operational status was confirmed by its presence on one security blocklist, PhishDestroy. No detections were recorded by the 95 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm the domain's safety or legitimacy. Defenders are advised to treat this domain as malicious based on its registration details, hosting infrastructure, and inclusion on a security blocklist.

Network-level blocking of the IP address 54.192.51.87 and monitoring for related domains registered through Go Daddy, LLC, or utilizing AWS nameservers may mitigate further risks. Given the domain's offline status, retrospective analysis of logs for connections to 54.192.51.87 or raydium.firebid.xyz is recommended to identify potential compromise. The exact content and functionality of the phishing page remain unanalyzed, though the combination of the page title, scam type, and brand target strongly suggests a focus on cryptocurrency theft.