ray-dium[.]cfd

The domain ray-dium.cfd was registered on 21 February 2026 and is presently taken offline. DNS resolution points to 104.21.79.80, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presented a TLS certificate identified as WE1 and served a page whose HTML title read “Raydium Staking,” indicating a wallet‑seed phishing campaign that impersonates the Raydium brand. Threat intelligence sources corroborate the malicious intent: AlienVault OTX includes the domain in one pulse, and two independent blocklist operators—PhishDestroy and ScamSniffer—have listed it.

VirusTotal analysis shows that two of ninety‑three scanning engines flagged the domain, reinforcing the suspicion. The Gridinsoft trust score of 0 / 100 reflects an extremely low reputation. No additional hosting or infrastructure details are available beyond the Cloudflare front‑end, and the content of the page has not been captured, leaving the exact phishing workflow unverified.

Given the convergence of registration timing, brand‑targeted page title, low trust score, and detection by multiple vendors, the evidence is sufficient to classify ray-dium.cfd as a confirmed wallet‑seed phishing site. Defenders should add the domain to local deny lists, ensure that the associated IP address (104.21.79.80) is blocked at network perimeters, and monitor for any re‑registration attempts. Security teams should also propagate the indicators to threat‑sharing platforms and advise users of Raydium‑related services to remain vigilant for unsolicited requests for private keys or seed phrases.