raydium-ui-v3-inner[.]pages[.]dev

The domain raydium-ui-v3-inner.pages.dev is an active phishing site impersonating the Raydium brand, as indicated by its page title 'Swap Raydium' and confirmed brand target classification. Registered on February 26, 2026, through Cloudflare, Inc., this domain resolves to the IP address 188.114.97.3 and employs a valid SSL certificate issued by Google Trust Services. Despite its recent registration, the site has already been flagged by three security blocklists, including SEAL, MetaMask, and PhishDestroy, signaling high-risk activity. Infrastructure analysis reveals the use of HSTS, Google Analytics, and Cloudflare technologies, alongside HTTP/3 support, which may be leveraged to enhance the site's perceived legitimacy or evade detection. The domain currently shows zero detections on VirusTotal, though this does not preclude malicious intent, as phishing infrastructure often remains undetected during early deployment phases. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk entity. The exact nature of the phishing scheme remains unconfirmed, as no specific scam category (e.g., crypto drainer, credential harvesting) has been identified in the available data. However, the combination of brand impersonation, recent registration, and active blocklisting suggests a targeted campaign. Defenders should treat this domain as hostile and prioritize blocking or monitoring interactions with it, particularly in environments where Raydium or similar decentralized finance platforms are relevant. Additional analysis of the site's content and behavior is recommended to determine the precise attack vector.