raydiunn[.]co[.]com

This domain is flagged as a brand impersonation threat with an elevated risk level, specifically targeting users of the Across cross-chain bridge protocol. The site presents itself as a legitimate wallet connection portal for Raydium liquidity swaps, a common tactic to deceive cryptocurrency users into exposing private keys or seed phrases during the connection process. Analysis indicates the domain raydiunn.co.com is currently offline but was previously active with notable malicious indicators. It resolves to IP address 104.21.94.254, hosted on Cloudflare infrastructure (AS13335). The domain lacks an SSL certificate, increasing the likelihood of interception during credential transmission. VirusTotal detection shows 15 out of 95 security vendors flagging this domain as malicious. It appears on two security blocklists, including PhishDestroy and PhishingDB, and was registered through Cloudflare, Inc. The page title found during analysis reads 'Swap Raydium - Liquidity - Connect Wallet,' directly referencing cryptocurrency operations to lend credibility to the fraudulent site. Mitigation against this type of brand impersonation threat requires heightened user awareness and technical safeguards. Users should verify domain authenticity by cross-referencing official project documentation before connecting wallets. Browser-based security extensions that block known phishing domains should be employed, and wallet software should be configured to reject connections from untrusted sources. Organizations managing cryptocurrency infrastructure should monitor for domains using similar naming patterns or impersonating their brand, particularly those hosted on content delivery networks that obscure origin servers. Network-level blocking of the resolved IP address (104.21.94.254) and domains with the 'ca82b1' seed pattern can prevent access to this and related malicious infrastructure.