ray-diun[.]biz

Analysis indicates that the domain ray-diun.biz was registered on April 20 2026 through Dynadot Inc. The authoritative name servers are celeste.ns.cloudflare.com and kareem.ns.cloudflare.com, placing the site behind Cloudflare’s network (AS13335) with the resolved address 188.114.96.3 located in the United States. The service presents an HTTPS endpoint secured by a Let’s Encrypt certificate (issuer “YE2”) and supports HSTS and HTTP/3, confirming modern TLS configuration. An HTTP request returns a 403 status code and the page title “Nur einen Moment…”, which offers no further functional evidence of malicious content. Multiple security‑vendor feeds have flagged the domain as a brand‑impersonation campaign targeting Raydium.

It appears on four blocklists and has been explicitly blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. AlienVault OTX records the domain in a single threat‑intelligence pulse, reinforcing its malicious reputation. VirusTotal scans show two of ninety‑one security vendors flag the domain, indicating limited but non‑trivial detection. The current operational status is offline, suggesting the infrastructure has been taken down or is no longer serving content.

However, the presence of the domain on active blocklists and its recent creation date imply a short‑lived phishing campaign that could be resurrected with minor modifications. Defenders should continue to deny network connections to 188.114.96.3, enforce domain‑level blocking for ray-diun.biz, and monitor for re‑registration or similar Cloudflare‑hosted domains that mimic the same brand target. Ongoing watch‑list updates from the listed vendors and periodic re‑scans are recommended to capture any re‑emergence.