raydium[.]io-4ef[.]pro

Analysis of the domain raydium.io-4ef.pro indicates a crypto scam impersonating the Raydium brand, active as of July 24, 2026. The domain was registered on February 21, 2026, and is currently offline. Infrastructure analysis reveals it resolved to IP 104.21.78.217, hosted on Cloudflare's network (AS13335) in the US. The SSL certificate is classified as WE1, a low-trust category often associated with malicious infrastructure. The page title 'Swap Raydium' aligns with the targeted brand, suggesting an attempt to mimic Raydium's legitimate swap interface.

Detection data is limited but indicative of malicious intent. The domain appears on one security blocklist (PhishDestroy) and was flagged by 1 of 93 security vendors on VirusTotal. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. No additional details about the scam mechanics, such as wallet addresses or lure tactics, are available at this time, as the exact page content has not been analyzed. Defenders should treat this domain as a confirmed impersonation threat.

Blocklist the domain and IP 104.21.78.217 at perimeter security controls. Monitor for related domains using the 'io-4ef.pro' pattern or similar variations targeting Raydium. If internal logs show user traffic to this domain, initiate incident response procedures for potential crypto theft exposure. Given the domain's offline status, further forensic evidence may be limited, but historical DNS and SSL certificate data should be preserved for retrospective analysis.