raydiumapps[.]com

Analysis of raydiumapps.com shows a high‑risk brand‑impersonation campaign targeting Raydium. The domain was registered on February 21 2026 through Hello Internet Corp and immediately pointed to Cloudflare’s network, using the authoritative nameservers dana.ns.cloudflare.com and ethan.ns.cloudflare.com. DNS resolution returns the IP address 104.21.71.252, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. No SSL certificate is present, meaning the site served only unencrypted HTTP traffic, a common trait of malicious infrastructure that avoids the cost and monitoring overhead of TLS. The domain appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of malicious intent.

Reputation services provide further evidence of abuse. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of legitimate reputation. VirusTotal analysis recorded 14 detections out of 93 scanning engines, confirming that a notable subset of security vendors recognize the domain as malicious. The cumulative signals justify the high‑risk rating assigned by the reporting system.

Despite these indicators, the content hosted at the URL has not been publicly examined; no page title, HTTP status code, or visible payload information is available in the current intelligence set. Consequently, the exact mechanisms employed—such as credential harvesting pages or malicious downloads—remain uncertain. Defenders should treat the domain as hostile and block all outbound and inbound traffic to it at the network perimeter. Continuous monitoring of the associated IP address and Cloudflare name servers is advised, as threat actors frequently reuse this infrastructure for other campaigns. Organizations using Raydium services should educate users about unsolicited communications that reference Raydium and verify URLs before entering credentials.