raydium-swap[.]in

Analysis indicates that the domain raydium-swap.in was registered on September 26, 2025 through Web Commerce Communications Limited and is presently taken offline. The site presented the page title “Raydium : The Best Way To Swap Solana,” directly referencing the Raydium brand, and is classified as a wallet/seed phishing campaign. No SSL certificate was observed, which is consistent with many fraudulent sites that avoid HTTPS to reduce cost and operational overhead. DNS resolution points to the IP address 172.67.160.136, hosted within AS13335 Cloudflare, Inc., located in the United States.

The domain employs Cloudflare nameservers bristol.ns.cloudflare.com and eugene.ns.cloudflare.com, a common pattern for abuse actors leveraging reputable infrastructure to obscure origin. Threat intelligence feeds have recorded the domain on three security blocklists and it is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple protective services have identified it as malicious. AlienVault OTX includes the domain in one pulse, providing additional corroboration of its malicious nature. VirusTotal scans returned eight positive detections out of ninety‑five scanners, reinforcing the suspicion of phishing activity.

While the offline status limits immediate observation of the site’s content, the available evidence—brand impersonation, targeted page title, lack of TLS, and multiple vendor detections—strongly supports a credential‑harvesting intent aimed at Raydium users. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑hosting attempts, and advise users to verify URLs and avoid entering wallet seeds on untrusted sites. Ongoing surveillance of the associated IP range and Cloudflare‑hosted domains is recommended to detect potential redeployment of the same infrastructure.