v2-app-raydium[.]cc

This domain, v2-app-raydium.cc, is flagged for brand impersonation targeting Raydium, a Solana-based automated market maker and liquidity provider. Analysis indicates the site mimics Raydium’s official interface, presenting itself as a legitimate crypto exchange platform under the title 'Raydium - Solana AMM & Liquidity Provider | Crypto Exchange.' The threat type is classified as brand impersonation, likely designed to harvest user credentials, private keys, or facilitate unauthorized fund transfers through deceptive transaction prompts. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.134.89 and is currently offline. The domain is detected by 6 out of 95 security vendors on VirusTotal, with three active security blocklists flagging it as malicious. The SSL certificate is issued by Google Trust Services, and the site employs technologies including jQuery, OWL Carousel, Cloudflare Browser Insights, and HTTP/3, indicating a structured and potentially automated deployment. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. As of the latest assessment, v2-app-raydium.cc has been taken offline, likely due to enforcement actions by security providers such as MetaMask, SEAL, and PhishDestroy. However, residual risk persists due to the domain’s recent registration date and the transient nature of such threats. Users who interacted with the domain are advised to revoke any connected wallet permissions, rotate credentials, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.