raydiummweb[.]pages[.]dev

The domain raydiummweb.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.100, which is advertised as belonging to AS13335 Cloudflare, Inc. in the United States. Network‑level fingerprints show that the site was served over HTTPS with HSTS enabled and HTTP/3 support, and the presented certificate chains to Google Trust Services (issuer “Google Trust Services / WE1”). The public page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, indicating that the resource is blocked by Cloudflare’s internal safeguards. Multiple defensive feeds have flagged the domain.

Four independent security blocklists list the address, and the domain is explicitly blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal reports that 12 of 93 scanned security vendors raise a detection, while Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The site is categorized as a “Crypto Scam” and is reported to impersonate the DeFi platform Raydium. As of the reporting date (23 July 2026) the domain is reported offline, suggesting that the hosting provider has taken the site down or that the attacker has ceased activity.

No further content analysis is available beyond the Cloudflare‑generated title, and the exact phishing payload or credential‑capture mechanisms have not been disclosed. Defenders should continue to block the domain at network perimeter and endpoint layers, incorporate the observed IP address and DNS records into threat‑intel feeds, and monitor the associated Cloudflare nameservers (ed.ns.cloudflare.com, aisha.ns.cloudflare.com) for any future re‑registration. Given the low trust score, multiple blocklist listings, and confirmed impersonation of a high‑value cryptocurrency brand, the domain should be treated as high‑risk until confirmed remediation.