raydiumio-swap[.]typedream[.]app

The domain raydiumio-swap.typedream.app was created on 21 February 2026 through Squarespace Domains II LLC and is currently offline, returning an HTTP 404 status. DNS resolution points to IP address 172.67.206.36, which belongs to AS13335 owned by Cloudflare, Inc., and the server is located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, indicating a valid‑looking HTTPS endpoint. A scan on VirusTotal recorded 10 detections out of 95 security vendors, confirming that multiple scanners flag the domain as malicious. The site appears on three public blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a crypto‑related scam.

Technical fingerprinting shows the presence of Node.js, React, Next.js, Google Cloud services (including Cloud Trace and CDN), and Webpack, all delivered behind Cloudflare’s edge network. The page title retrieved during analysis is "Raydium - Swap for Token trading. DEX Exchange," which directly references the legitimate Raydium brand and aligns with the declared scam type of a crypto impersonation. The evidence indicates that the domain was designed to mimic Raydium’s token‑swap functionality, likely to lure users into providing wallet credentials or transferring assets.

While the site is no longer reachable, the infrastructure—particularly the Cloudflare front‑end and Google‑issued certificate—could be reused for future impersonation attempts. Defenders should continue to block the domain at network perimeter controls, monitor the associated IP range for any re‑registration, and add the domain to internal threat feeds. Users of Raydium should be warned to verify URLs carefully and avoid interacting with any site that references Raydium swap services unless it is the official, verified domain.