raydiumsmartlive[.]xyz

raydiumsmartlive.xyz was registered on 2026-01-03 through OwnRegistrar, Inc. and resolves to the IPv4 address 158.94.208.165, which is announced by AS202412 (Omegatech LTD) and geolocated to Germany. The domain uses Cloudflare’s authoritative nameservers fonzie.ns.cloudflare.com and luciana.ns.cloudflare.com, but no TLS certificate is presented for the host, indicating HTTP‑only service. An HTTP request to the root path returned a 404 Not Found page title, and the site has since been taken offline. Threat intelligence classifies the domain as a crypto‑related scam that impersonates the decentralized exchange platform Raydium.

The malicious infrastructure was flagged by PhishDestroy and is listed on a single public blocklist. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis shows that 10 of 93 scanning engines reported the domain as malicious, corroborating the blocklist detection. The combination of a recent registration date, German‑based IP belonging to a hosting provider, absence of HTTPS, and low trust scores are consistent with a short‑lived impersonation campaign targeting Raydium users.

Because the site is currently offline, content analysis is limited to the observed 404 response; no further page artifacts or payloads have been captured. Defensive recommendations include adding the domain to deny lists on perimeter and DNS filtering solutions, monitoring for newly registered .xyz domains that reference Raydium or similar keywords, and reviewing outbound traffic for connections to the 158.94.208.165 address. Continued observation of the associated IP range and Cloudflare name servers may reveal additional clones employing the same hosting configuration.