m-raydium[.]pages[.]dev

On 23 July 2026, the domain m-raydium.pages.dev was observed to host a brand‑impersonation campaign targeting Raydium. The site’s HTML title, “Suspected phishing site | Cloudflare”, indicates that the page has been flagged by Cloudflare’s protective mechanisms. Registration data shows the domain was created on 21 February 2026 and was provisioned through Cloudflare, Inc., using the nameservers adi.ns.cloudflare.com, emma.ns.cloudflare.com, guss.ns.cloudflare.com, and karl.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335, owned by Cloudflare, Inc., and is geolocated in the United States. The server presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming the use of legitimate SSL infrastructure. HTTP responses return a 403 status code, and the server advertises HSTS and HTTP/3, consistent with Cloudflare’s edge services.

Threat intelligence platforms have classified the domain as a brand‑impersonation vector. The Gridinsoft trust score is 0 out of 100, indicating a high confidence of malicious intent. Twelve of ninety‑three antivirus engines on VirusTotal flagged the domain, and the domain appears on three external security blocklists. It has also been blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that the infrastructure is being used for malicious phishing attempts against Raydium users. The current operational status is offline, which limits direct observation of payloads or credential‑harvesting pages. No additional artefacts such as JavaScript kits, redirect chains, or malicious binaries have been publicly disclosed.

Consequently, the exact phishing workflow and any associated command‑and‑control infrastructure remain uncertain. Defenders should continue to block the domain at network perimeters and update endpoint protection signatures to reflect the twelve VirusTotal detections.