cpcontacts[.]raydium[.]quest

This domain, cpcontacts.raydium.quest, presents a brand impersonation threat targeting Raydium users through a fraudulent staking interface. Analysis indicates the site was designed to mimic legitimate Raydium staking portals, likely to harvest cryptocurrency wallet credentials or private keys under false pretenses. The page title explicitly reads 'Raydium Staking,' reinforcing the deception by aligning with expected user interactions for yield farming or token delegation services. Such schemes typically exploit trust in decentralized finance platforms to execute unauthorized transactions or drain user funds once credentials are compromised.

Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on November 6, 2025, through Dynadot LLC, with an unusually recent creation date suggesting short-term malicious intent. It resolves to the IPv6 address 2606:4700:3037::ac43:8116 and appears on one security blocklist, while VirusTotal reports detection by 3 out of 95 security vendors. Gridinsoft assigns a trust score of 0/100, further corroborating the elevated risk classification. The domain has since been taken offline, though historical DNS records and cached content may still pose residual threats.

Users who visited cpcontacts.raydium.quest should immediately revoke any wallet permissions associated with the site and monitor connected accounts for unauthorized transactions. If credentials were entered, affected wallets should be considered compromised, and funds transferred to a new secure wallet. Enable multi-factor authentication on all cryptocurrency-related accounts and review recent transaction histories for anomalies. Security teams are advised to block the domain and its resolving IP at the network level to prevent potential re-emergence or lateral movement within corporate environments.