raydium-sol[.]cc

This domain, raydium-sol.cc, was observed to resolve to the IPv4 address 195.2.85.214, which is announced by AS48282 Hosting technology LTD and geolocated to Russia. The domain was registered on September 01, 2025 through Spaceship, Inc., and the authoritative nameservers are morgan.ns.cloudflare.com and ngrid.ns.cloudflare.com. No TLS certificate is presented, indicating that the site is served over plain HTTP. The page title returned by the server reads “Raydium Exchange: Solana’s Premier DeFi Swap Platform”, matching the brand target Raydium and confirming the impersonation intent.

The threat classification in the intelligence is wallet/seed phishing, consistent with an attempt to harvest private keys or seed phrases from users who believe they are interacting with the legitimate Raydium service. VirusTotal analysis recorded 12 detections out of 95 security vendors, reflecting a moderate level of consensus among scanning engines. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed on a single external security blocklist. PhishDestroy has already taken the domain offline, and its current status is reported as offline.

Despite the offline state, the infrastructure artifacts remain valuable for attribution and for building detection rules. Defensive recommendations include adding 195.2.85.214 and the domain name raydium-sol.cc to network‑level blocklists, monitoring DNS queries for the associated Cloudflare nameservers, and flagging any HTTP requests lacking TLS that present the Raydium branding in logs. Continuous re‑scanning of the domain on VirusTotal and other multi‑engine platforms is advised to capture any changes in detection ratios. Organizations protecting cryptocurrency assets should also educate users about the absence of HTTPS and the likelihood of seed‑phishing attempts associated with this indicator.