swaap-raydium-io-us[.]pages[.]dev

This domain, swaap-raydium-io-us.pages.dev, is identified as a brand impersonation threat targeting Raydium, a decentralized exchange platform on the Solana blockchain. The site mimics the legitimate Raydium Swap interface, specifically replicating the page title 'Raydium Swap - Decentralized Token Swaps on Solana,' to deceive users into disclosing wallet credentials or authorizing malicious transactions. Current status indicates the domain has been taken offline, though prior activity remains a documented risk. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was flagged by 3 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. Infrastructure analysis shows it was registered through Cloudflare, Inc., with a creation date of February 21, 2026, and resolves to the IP address 172.66.46.214. The domain appears on three security blocklists and is actively blocked by wallet security extensions and phishing detection tools. Technologies detected include HSTS, Cloudflare hosting, and HTTP/3, with an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy. The domain is currently offline, reducing immediate exposure risk. However, users who interacted with the site prior to takedown should assume credential compromise and take immediate remedial action. Recommended steps include revoking any active token approvals associated with the domain, rotating wallet private keys, and monitoring transaction histories for unauthorized activity. Security teams should update blocklists to include this domain and its resolved IP address. Given the elevated risk level and documented impersonation tactics, ongoing vigilance is advised for similar domains leveraging Cloudflare Pages infrastructure to mimic decentralized finance platforms.