raydium[.]graphy[.]com

This domain is flagged as an elevated-risk brand_impersonation threat specifically targeting Raydium, a decentralized finance platform. Analysis indicates the infrastructure was designed to deceive users into believing they are interacting with the legitimate Raydium interface, likely to harvest wallet credentials or private keys. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain raydium.graphy.com was registered through Amazon Registrar, Inc. on February 21, 2026, and resolves to IP address 152.42.156.175. Security vendors flagged the domain on VirusTotal with 3/95 detections, while Gridinsoft assigned a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms. Detected technologies include Node.js, Nginx, React, and OpenResty, with a Let's Encrypt SSL certificate and Google Tag Manager integration, suggesting a sophisticated frontend designed to replicate legitimate crypto service interfaces. Mitigation for this brand_impersonation threat requires immediate action from both users and security teams. Users should verify domain authenticity by cross-referencing official Raydium communication channels before entering credentials. Security teams should implement DNS-based blocking for this domain and its resolved IP, while monitoring for similar impersonation patterns using the detected technologies (Next.js, React) and registrar (Amazon Registrar). Incident responders should prioritize credential reset protocols for any users who may have interacted with this domain, particularly given its use of HSTS and SSL encryption to appear legitimate.