raydium-web-wallet[.]typedream[.]app

Analysis of the domain raydium-web-wallet.typedream.app indicates it was actively impersonating a cryptocurrency wallet service associated with Solana, despite being labeled under the broader 'ethereum' brand target in initial reports. The domain, registered on February 21, 2026, through Squarespace Domains II LLC, resolved to the IP address 172.67.206.36, hosted on Cloudflare's infrastructure (AS13335) in the United States. The page title, 'Swap Raydium: Your Gateway to Lightning-Fast Token Swaps on Solana,' suggests an attempt to mimic Raydium, a legitimate decentralized exchange on the Solana blockchain, likely to deceive users into interacting with fraudulent wallet or swap functionality. The domain was flagged by six of 95 security vendors on VirusTotal, though this detection rate alone does not confirm the exact nature of the threat. It appeared on three security blocklists and was explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a crypto scam.

The HTTP status returned a 403 Forbidden response at the time of assessment, and the domain is now offline. SSL certification was provided by Google Trust Services (WE1), a common feature of both legitimate and malicious sites leveraging Cloudflare. Infrastructure analysis reveals the use of modern web technologies, including Node.js, React, Next.js, and Webpack, alongside Google Cloud services (Trace, CDN). These tools are frequently employed in both legitimate and phishing sites, offering no definitive indication of malicious intent on their own. The nameservers, annalise.ns.cloudflare.com and darwin.ns.cloudflare.com, are consistent with Cloudflare-protected domains, which are often used to obfuscate hosting origins.

Defenders should treat this domain as part of a broader pattern of cryptocurrency-related phishing infrastructure.