acceess-rayidium-swap[.]pages[.]dev

This domain, acceess-rayidium-swap.pages.dev, is identified as a high-risk cryptocurrency wallet phishing site targeting users of the Raydium decentralized exchange. Analysis indicates the site was designed to mimic legitimate Raydium swap interfaces, tricking victims into entering wallet credentials or approving malicious smart contracts. The domain specifically harvests private keys, seed phrases, or transaction signatures, enabling attackers to drain funds from connected cryptocurrency wallets. The threat extends to users of browser-based and hardware wallets, with evidence suggesting the site employs Web3 injection techniques to bypass security warnings. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on April 08, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.127. It is currently flagged by 12 out of 95 security vendors on VirusTotal, including detections for generic phishing and cryptocurrency fraud. The domain appears on three independent security blocklists and is actively blocked by wallet security extensions and transaction monitoring tools. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. The page title, 'Suspected phishing site | Cloudflare,' further confirms its malicious classification by the hosting provider. Users who visited acceess-rayidium-swap.pages.dev should assume their wallet credentials or transaction data may have been compromised. Immediate actions include revoking all active smart contract approvals via a blockchain explorer, transferring funds to a new wallet address, and monitoring transaction histories for unauthorized activity. If private keys or seed phrases were entered, the compromised wallet should be considered permanently exposed, and all associated assets should be moved to a new, secure wallet. Users are advised to scan their devices for malware, as phishing sites may deploy additional payloads. Future interactions with decentralized finance platforms should be conducted only after verifying domain authenticity and using hardware-based wallet protections.