raydiat[.]org

On July 25, 2026 analysts observed that the domain raydiat.org, created on November 2, 2025, is currently offline but exhibits multiple indicators of a wallet/seed phishing operation targeting the Raydium brand. The site resolves to the IP address 172.67.215.16, which is assigned to AS13335 Cloudflare, Inc., located in the United States. DNS resolution uses Cloudflare‑provided nameservers donovan.ns.cloudflare.com and ines.ns.cloudflare.com, confirming registration through Cloudflare, Inc. HTTP requests to the host return a 403 status code, and the service is advertised as supporting HTTP/3, suggesting modern web infrastructure.

The TLS certificate presented is issued by Google Trust Services under the WE1 designation, a legitimate certificate authority, which may be used to lend credibility to the phishing page. The page title returned by the server is "Swap Raydium," directly referencing the targeted brand. VirusTotal analysis recorded six detections out of ninety‑five security vendors, and the domain appears on a single blocklist, specifically PhishDestroy, which has already flagged the host.

Although the site is presently taken offline, the combination of brand impersonation, wallet/seed phishing classification, and active blocklist entry indicates a credible threat. Defenders should continue to block the IP 172.67.215.16, add raydiat.org to domain deny lists, monitor for any re‑hosting attempts within Cloudflare’s network, and employ endpoint detection to catch any payloads associated with the six reporting vendors. Ongoing surveillance of related Cloudflare‑registered domains is recommended to pre‑empt potential re‑deployment of the campaign.