raydium-exchange[.]org

On 23 July 2026, raydium-exchange.org was observed to host a page titled "Raydium: Solana DEX for Fast Swap Exchange". The page title directly references the legitimate Raydium platform, indicating a brand-impersonation attempt aimed at cryptocurrency users. The domain was registered on 21 February 2026 through Web Commerce Communications Limited and is served by the nameservers ns100.webnic.cc and ns101.webnic.cc. DNS resolution points to IP address 104.21.8.98, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. No TLS certificate was presented, implying the site was delivered over plain HTTP when it was active.

The site has been taken offline and is currently listed as blocked by PhishDestroy and appears on a single security blocklist. VirusTotal analysis recorded nine detections out of ninety-three scanners, confirming malicious classification by multiple vendors. AlienVault OTX references the domain in one threat-intel pulse, further supporting its association with a crypto-related scam. The available evidence suggests the domain was used to impersonate the Raydium brand in order to lure victims into a crypto-draining scheme, although the specific payload or credential-harvesting mechanisms have not been publicly disclosed.

Uncertainty remains regarding the exact phishing workflow, the presence of any malicious code, and whether the site ever served a functional login form. Defenders should add the domain to blocklists, monitor DNS queries for the associated IP and nameservers, and enforce outbound filtering of HTTP traffic to the host. Continuous re-scanning with sandbox and reputation services is advised in case the infrastructure is re-activated. Incident response teams should also alert users of the Raydium ecosystem to the impersonation attempt and advise verification of URLs before any transaction.