smartdecentrilized[.]pages[.]dev

This domain, smartdecentrilized.pages.dev, was observed hosting a page titled “Raydium” and is explicitly classified as a fake‑airdrop impersonating the Raydium brand. The site returned HTTP 403, indicating that the content is not publicly reachable, and it has been taken offline at the time of reporting. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. Registration was performed through Cloudflare on April 16 2025, using the nameservers harlan.ns.cloudflare.com and kallie.ns.cloudflare.com.

The TLS certificate is issued by Google Trust Services under the WE1 root, and the server advertises HSTS, HTTP/3, and other Cloudflare security features. Reputation data is unfavorable: Gridinsoft assigns a trust score of 0 / 100, and 13 of 95 VirusTotal scanners have flagged the domain. It appears on two independent blocklists—PhishDestroy and ScamSniffer—both of which label it as a fake‑airdrop scam. The page title matches the targeted brand, confirming the impersonation claim.

Because the site is currently offline, direct observation of the payload is not possible, and the exact phishing kit or collection mechanisms remain unknown. Defenders should immediately add the domain and its IP address to network deny lists, update URL filtering rules, and ensure that endpoint protection solutions incorporate the observed VirusTotal detections. Continuous monitoring of Cloudflare‑registered subdomains that reference Raydium or use similar naming patterns is recommended, as the threat actor may reuse the infrastructure for future campaigns. Analysts should also watch for new registrations that resolve to the same IP range or that exhibit the same TLS issuer, as those attributes have proven useful for early identification of related malicious infrastructure.