raydiumwallet-us[.]pages[.]dev

This domain constitutes a high-risk brand_impersonation threat specifically targeting Raydium, a decentralized finance protocol. Analysis indicates the site was designed to mimic legitimate Raydium wallet interfaces, likely to harvest cryptocurrency wallet credentials, private keys, or seed phrases from unsuspecting users. The infrastructure was structured to exploit trust in the Raydium brand, potentially leading to unauthorized asset transfers or complete account takeovers. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on October 28, 2025, through Cloudflare, Inc., and currently appears on three security blocklists. VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious, with Google Safe Browsing explicitly labeling it as phishing. The site resolved to IP address 172.66.46.213, hosted on Cloudflare's network (AS13335), and used an SSL certificate issued by Google Trust Services (WE1). The page title, 'Suspected phishing site | Cloudflare,' further corroborates its fraudulent nature. Users who visited raydiumwallet-us.pages.dev should take immediate action to mitigate potential compromise. Disconnect any active wallet sessions associated with the domain and revoke permissions for connected decentralized applications. Conduct a thorough review of wallet transaction history for unauthorized activity, and consider migrating assets to a new wallet if any suspicious transactions are detected. Monitor accounts for unusual login attempts or phishing communications, and report the incident to relevant security teams for further investigation.