raydium-en-us[.]pages[.]dev

The domain raydium-en-us.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.89, which is hosted by Cloudflare (AS13335) in the United States. The site presents a HTTP 403 response and serves a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid SSL chain despite the malicious intent. The page title returned by the server is "Suspected phishing site | Cloudflare," and the service advertises HSTS, Cloudflare edge protection, and HTTP/3 support. Infrastructure analysis shows the domain is delegated to the nameservers yahir.ns.cloudflare.com and keyla.ns.cloudflare.com, both belonging to Cloudflare's DNS infrastructure.

Detection data indicates that the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded ten positive detections out of ninety-three scanned security vendors, reinforcing the classification as a crypto‑related scam. Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence in malicious behavior. The site is identified as impersonating the Raydium brand and is categorized as a crypto scam.

As of the report date, July 23, 2026, the domain is reported offline, but the underlying IP and hosting configuration remain active within Cloudflare's network. Defenders should continue to enforce blocklists that include this domain, monitor for any re‑registration of similar subdomains under the pages.dev namespace, and consider network‑level filtering of the associated IP range. Continuous observation of Cloudflare‑hosted assets linked to the same nameservers is advised, as threat actors frequently recycle infrastructure.