raydium[.]io-inputmint[.]pro

The domain raydium.io-inputmint.pro was registered on 2 December 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. It is configured to use the Cloudflare nameservers amy.ns.cloudflare.com and kai.ns.cloudflare.com and resolves to the IP address 172.67.160.150, which is announced by AS13335 Cloudflare, Inc. in the United States. No SSL certificate is present, so the site would be reachable only over plain HTTP. The domain is currently taken offline, but it was previously blocked by the PhishDestroy feed and appears on one additional security blocklist.

VirusTotal recorded three positive detections out of ninety‑three scanners, indicating that multiple anti‑malware engines identified the host as malicious. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification. The campaign is labeled as a crypto‑scam that impersonates the Raydium brand, consistent with the “brand impersonation” threat type.

Publicly available evidence does not include a page title or detailed payload analysis, so the exact content served at the URL remains unknown. Defenders should continue to deny any network traffic to the resolved IP address, enforce blocking of the domain at DNS and proxy layers, and monitor for newly registered domains using the same registrar or similar naming patterns that target Raydium users. Incident response teams are advised to add the IP address 172.67.160.150, the domain name, and the associated ASN to their indicator sets and to share these artifacts with industry sharing groups.