access-swap-raydium[.]pages[.]dev

This domain is flagged for elevated risk due to targeted brand impersonation, specifically mimicking Across Protocol under the guise of a Solana-based decentralized exchange. The threat type involves fraudulent swap interfaces designed to deceive users into connecting wallets and authorizing malicious transactions, leading to potential asset theft. Analysis indicates the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 172.66.47.3. Security vendors on VirusTotal flagged the domain at a rate of 2/95, while it appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services, and the page title, 'Swap on Raydium DEX — Lightning-Fast Solana Trading,' reinforces the impersonation of legitimate trading platforms. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious nature. The domain has since been taken offline, though historical activity remains a concern. Mitigation steps for this threat type include immediate blacklisting of the domain and associated IP across security gateways. Organizations should monitor for wallet connection attempts to similar domains, particularly those impersonating decentralized finance platforms. End users should verify domain authenticity by cross-referencing official project documentation and avoiding interaction with unsolicited swap interfaces. Security teams are advised to review transaction logs for connections to 172.66.47.3 or related infrastructure to identify potential compromise.