rayclaim[.]pages[.]dev

rayclaim.pages.dev was observed hosting a page titled “Raydium Airdrop Claim”. The site was registered on 21 February 2026 and is hosted behind Cloudflare’s network, resolving to IP 172.66.47.152, which belongs to AS13335 (Cloudflare, United States). No TLS certificate is presented; the connection is served without HTTPS. The domain is currently offline, and its HTTP status is reported as unavailable. Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has added it to its blocklist.

The page is identified as part of an “Airdrop Scam” kit, a known template used to lure victims with a fake cryptocurrency airdrop. The brand target is Raydium, matching the page title and confirming a brand‑impersonation attempt. VirusTotal records indicate the URL was scanned by 93 security vendors, none of which raised a detection at the time of analysis; this absence of detections does not constitute a safety guarantee. The domain appears on one additional security blocklist, reinforcing its malicious reputation.

Defenders should continue to block the domain and its associated IP, monitor for any re‑activation, and incorporate the indicator set (domain, IP, page title, kit name) into threat‑intel feeds. Because the site lacks a valid SSL certificate and is hosted on a shared Cloudflare edge, any future re‑hosting could inherit the same infrastructure, so network‑level filtering of the IP range and Cloudflare‑associated ASN is advisable. Organizations using Raydium services should educate users about unsolicited airdrop claims and advise verification through official channels. Ongoing reconnaissance should verify whether the underlying kit is being reused elsewhere, and any new sightings should be reported to relevant phishing‑tracking platforms.