cpanel[.]raydium-token[.]xyz

The domain cpanel.raydium-token.xyz is identified as a brand impersonation threat specifically targeting Raydium, a known decentralized finance platform. Currently, the domain is offline, but prior analysis confirms its malicious intent to deceive users by mimicking legitimate Raydium infrastructure. This assessment is based on concrete technical indicators and historical behavior observed in similar fraudulent schemes. Analysis of the domain reveals it was flagged by 2 of 95 security vendors on VirusTotal, indicating early detection by a subset of threat intelligence systems. The domain appears on one security blocklist, further corroborating its suspicious nature. It was registered through OwnRegistrar, Inc. on September 28, 2025, and resolves to the IP address 104.21.66.48. The SSL certificate is issued by Google Trust Services under the identifier WE1, which, while legitimate in origin, is often exploited in impersonation attacks to lend a false sense of credibility. The page title 'Just a moment...' is consistent with evasion techniques used to delay or obscure malicious content from automated scanners. Given the domain's current offline status, immediate interaction risks are mitigated; however, the infrastructure remains a latent threat. Organizations and users are advised to block the domain at the DNS or firewall level to prevent future access attempts. Security teams should monitor for any re-emergence of the domain or related subdomains under the raydium-token.xyz namespace. Additionally, reviewing logs for prior connections to 104.21.66.48 or the domain itself can identify potential exposure. Users who may have interacted with the domain should verify wallet transactions and revoke any suspicious smart contract approvals associated with Raydium or similar platforms.