2d351e5fd29b4eb6[.]raydiumpro-web[.]shop

The domain 2d351e5fd29b4eb6.raydiumpro-web.shop was registered on 15 Oct 2025 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.215.91 located in the United States. The authoritative nameservers alaric.ns.cloudflare.com and brynne.ns.cloudflare.com resolve the domain to the same Cloudflare edge node, and no TLS certificate is presented, indicating the site was served over plain HTTP. The site’s HTML title reads “Raydium Pro”, matching the declared scam type of a crypto‑related scheme that impersonates the Raydium brand. Threat intelligence feeds have flagged the domain as a brand‑impersonation vector; PhishDestroy has already taken the site offline, and the domain appears on one external blocklist.

VirusTotal analysis shows 12 of 95 security scanners label the domain as malicious, providing additional corroboration of its fraudulent nature. No public Safe Browsing, OTX, or other reputation entries were observed at the time of analysis. Because the infrastructure relies on Cloudflare’s shared IP pool, the address is likely to host unrelated legitimate services, so blocking the IP alone could generate false positives.

Defenders should add the fully qualified domain name to URL filtering and DNS‑sinkhole rules, monitor for newly created subdomains that use the same “raydiumpro‑web.shop” suffix, and enforce email authentication checks to prevent phishing messages that reference the impersonated brand. Continuous observation of the registrar’s batch registrations and the two Cloudflare nameservers may reveal repeat abuse patterns. Until the domain is officially removed from blocklists, it should be treated as a confirmed malicious asset and excluded from trusted traffic lists.