rjkmdfjn[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Raydium, a decentralized finance platform. Analysis indicates the domain was designed to mimic legitimate Raydium services, as evidenced by the page title 'Swap Raydium' and its registration details. The infrastructure and content were structured to deceive users into interacting with fraudulent swap interfaces, likely aiming to harvest credentials or misappropriate funds.

Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on September 18, 2025, and previously resolved to the IP address 104.21.76.87. Security vendors on VirusTotal flagged the domain, with 2 out of 95 detecting it as malicious. The domain appears on two security blocklists and has been proactively blocked by at least two threat intelligence platforms. Its creation date aligns with recent phishing campaigns targeting decentralized finance platforms, suggesting a coordinated effort to exploit users during periods of heightened activity.

To mitigate risks associated with this brand impersonation threat, organizations and users should immediately block the domain and its associated IP address at the network level. Security teams are advised to monitor for similar domains registered through the same registrar or resolving to the same IP range, as these may indicate follow-up campaigns. Users should be educated on verifying domain authenticity before interacting with decentralized finance platforms, particularly those involving fund transfers or credential input. Additionally, enabling multi-factor authentication and employing browser-based security extensions can provide an additional layer of protection against such impersonation attempts.