radm[.]pages[.]dev

Analysis of radm.pages.dev indicates a brand‑impersonation campaign that mimics the Raydium decentralized exchange. The domain was registered on March 22, 2026 through Cloudflare, Inc., and it resolves to the Cloudflare‑owned IP address 172.66.44.241, geolocated to Canada. DNS resolution uses the Cloudflare authoritative name servers lia.ns.cloudflare.com and odin.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 CA, confirming the use of a valid TLS certificate despite the malicious intent. HTTP responses return a 403 status code, and the server advertises HSTS, Cloudflare, and HTTP/3 support. A Gridinsoft trust score of 0 / 100 further reflects the low reputation of the infrastructure.

On VirusTotal, one of ninety‑four scanning engines flagged the domain, and the domain appears on a single external blocklist, which is also the source for the PhishDestroy block. The page title "Swap Raydium" aligns with the declared brand target. The current operational status is offline, but the domain remains publicly listed and could be re‑activated.

Uncertainties remain regarding the payload delivered when the site is active, as no visual or functional analysis has been published. The limited detection count suggests either a short‑lived deployment or low visibility in the broader threat‑intel community. Defenders should continue to block the domain at network perimeter devices, update DNS‑based filtering with the observed IP and name‑server attributes, and monitor for re‑registration of similar Cloudflare‑hosted subdomains that reference Raydium. Ongoing collection of any additional detection signals, such as future VirusTotal scans or blocklist entries, will be essential for assessing whether the infrastructure is reused for further impersonation campaigns.