raydiumproea[.]org

Analysis indicates that the domain raydiumproea.org was registered on March 07, 2025 through Dynadot LLC and resolves to the Cloudflare‑owned address 172.67.151.133, ASN 13335 (Cloudflare, Inc.) located in the United States. The site presents an HTML title identical to the domain name and uses a Let’s Encrypt (R12) SSL certificate. DNS resolution is provided by the Cloudflare nameservers charles.ns.cloudflare.com and sandra.ns.cloudflare.com, and the observed technology stack includes Vue.js and HTTP/3, confirming reliance on Cloudflare’s edge platform. The domain has been classified as a crypto‑related brand impersonation of Raydium, is listed on a single security blocklist, and has been blocked by the PhishDestroy service.

VirusTotal records show that 95 scanning engines examined the domain without returning detections, but the absence of detections is not evidence of safety. The current host status is marked as taken offline, and the domain appears on only one blocklist, suggesting limited exposure at the time of observation. Uncertainties remain regarding the specific malicious payload or credential‑harvesting mechanisms, as no page content or network traffic has been captured.

The relatively short lifespan—approximately 16 months—combined with the abrupt takedown may indicate a campaign that was interrupted by remediation actions or was intended for transient use. Defenders should maintain monitoring of the domain’s DNS records for potential re‑activation, enforce existing blocklist entries, and consider adding the domain to internal threat‑intel feeds that track Raydium‑related impersonation attempts. Further analysis, such as sandbox execution of any retrieved page artifacts, would be required to confirm the presence of malicious code or phishing functionality.