raydiumpro-webs[.]net

This domain, raydiumpro-webs.net, was created on 24 October 2025 and is currently offline. It resolves to the Cloudflare IP address 172.67.137.195, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The domain is delegated to the Cloudflare nameservers langston.ns.cloudflare.com and zelda.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. No TLS certificate is presented, confirming the absence of HTTPS support at the time of observation. The site title returned from HTTP requests is “Raydium Pro”, matching the declared brand target “Raydium”. This alignment, together with the classification “Crypto Scam” in the intelligence feed, points to a brand‑impersonation attempt aimed at cryptocurrency users.

Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal scanned the domain and recorded a single positive detection out of 95 security scanners, reinforcing the suspicion of malicious activity. The domain appears on one security blocklist and is specifically blocked by PhishDestroy, providing independent corroboration. Registration was performed through Global Domain Group LLC, a registrar that does not inherently indicate malicious intent but is part of the public record. AlienVault OTX references the domain in one threat‑intel pulse, adding another source that has flagged it as suspicious.

Because the domain is offline, active probing of its content is not possible, leaving the exact payload or user‑interaction mechanisms unknown. However, the combination of brand‑targeted naming, low trust score, positive VirusTotal detection, blocklist listings, and the Cloudflare hosting pattern are consistent with known crypto‑related impersonation campaigns. Defenders should continue to monitor the IP address 172.67.137.195 for any re‑use in future campaigns, enforce outbound filtering for URLs containing “raydiumpro-webs.