raydium[.]noderesolv[.]help

On 22 July 2026, analysis was performed on the domain raydium.noderesolv.help, which is currently offline. The domain was registered on 21 February 2026 and resolves to the IPv4 address 212.1.212.102, hosted by Hostinger International Limited (AS47583) in the United States. The site presented the page title “Home Page: Welcome to our home page” and was classified as a crypto‑related scam that impersonates the Coinbase brand. VirusTotal recorded a single detection out of 93 scanned security vendors, indicating that at least one AV engine flagged the domain as malicious.

The domain appears on one public phishing blocklist and has been blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, and the SSL certificate was rated “R13”, suggesting weak or no encryption. No additional public intelligence such as OTX references or Safe Browsing alerts were observed. The limited evidence points to a short‑lived infrastructure typical of credential‑harvesting campaigns targeting cryptocurrency users.

Because the site is offline, content cannot be inspected for login forms or malicious payloads, leaving the exact phishing vector unknown. Defenders should continue to block the domain and its IP address at perimeter defenses, monitor for any resurgence of the same host or similar sub‑domains, and add the indicator set to internal threat‑intel feeds. Organizations using Coinbase services should remind users to verify URLs and enable multi‑factor authentication. Ongoing observation of the hosting provider and related ASN may reveal future reuse of the infrastructure.