nft-raydium[.]web[.]app

The domain nft-raydium.web.app is currently active and resolves to the IP address 199.36.158.100, which is owned by AS54113 Fastly, Inc. and geolocated in the United States. The site is served over HTTPS using a Google Trust Services certificate (WR4) and returns HTTP 200 responses. Infrastructure analysis shows the presence of Firebase hosting, Bootstrap, Vue.js, jsDelivr, jQuery, HSTS, and HTTP/3, indicating a modern web stack. Registration data shows the domain was created on April 10, 2024 and was registered through Google LLC. The page title "RAY NFT - Metaverse" and the explicit label of impersonating Raydium align with a crypto‑related brand impersonation campaign. VirusTotal recorded a single positive detection out of 95 scanners, and the domain is listed on one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing the malicious assessment. While the exact phishing flow or credential collection mechanism has not been observed, the combination of brand impersonation, crypto‑scam labeling, and the low trust score suggests a high‑risk profile. Defenders should add the domain to blocklists, monitor DNS queries for 199.36.158.100, enforce outbound filtering for traffic to this host, and apply user awareness messaging that the site is not affiliated with Raydium. Continuous re‑scanning is advised to capture any changes in detection status.