raydiumprotocol[.]world

The domain raydiumprotocol.world has been identified as a brand impersonation phishing threat, specifically targeting the decentralized exchange Raydium. This domain was designed to deceive users by mimicking the legitimate Raydium protocol interface, potentially leading to credential theft or wallet compromise. No known drainer kit was associated with this particular domain, but the risk to users remains significant due to the trusted brand being exploited.

Technical analysis reveals that raydiumprotocol.world has a VirusTotal detection rate of 6 out of 95 security vendors, indicating moderate but concerning malicious recognition. The domain was registered through Cloudflare, Inc., and resolves to IP address 188.114.97.3. Notably, the domain lacks an SSL certificate, which is a common red flag for phishing sites. It appears on one security blocklist and was flagged by Google Safe Browsing as a phishing site. The page title observed was "Nur einen Moment…" (German for "Just a moment…"), which suggests the site may have been loading or redirecting users to malicious content.

As of the latest check, raydiumprotocol.world has been taken offline, likely due to takedown actions by hosting providers or security researchers. However, users should remain vigilant as similar domains may resurface. PhishDestroy recommends that users avoid interacting with any unsolicited links claiming to be from Raydium, always verify URLs before connecting wallets, and use browser extensions that block known phishing sites. If you have already visited this domain, consider revoking any permissions granted and monitoring your accounts for suspicious activity.