un-swap-raydium[.]pages[.]dev

PhishDestroy identifies a new brand impersonation threat targeting Raydium users via un-swap-raydium.pages.dev. This fraudulent domain mimics Raydium's swap interface, luring users into entering private keys or wallet credentials under the false pretense of token swaps. The domain leverages Cloudflare's infrastructure, resolving to IP 172.66.47.130 with a legitimate Google Trust Services SSL certificate to appear authentic. Despite zero detections on VirusTotal (1/95), this site represents a high-risk threat to cryptocurrency users seeking legitimate DeFi platforms. This domain was flagged as active on Cloudflare, Inc.—registered with no public creation date visible—but was confirmed through network analysis resolving to 172.66.47.130. Its SSL certificate, issued by Google Trust Services, enhances its deceptive credibility, while VirusTotal's current 1/95 detection rate indicates a stealthy, emerging threat still under the radar of most antivirus engines. The impersonation specifically targets Raydium's swap functionality, a common vector for credential theft and unauthorized fund transfers. If you visited this domain, cease all interaction immediately and inspect your device for malware using tools like Malwarebytes or Windows Defender Offline Scan. Revoke any permissions granted to the site via your wallet provider and change passwords linked to Raydium accounts—never rely solely on the absence of VirusTotal detections. Report this domain to Raydium's official security channels and your local cybercrime unit to aid in takedown efforts and prevent further victimization. Always verify URLs via official Raydium domains (raydium.io or app.raydium.io) and enable wallet transaction simulation features to detect irregular fund movements.