6bf50c04bdd64f3c[.]raydiumpro-web[.]shop

The domain 6bf50c04bdd64f3c.raydiumpro-web.shop was registered on 15 October 2025 through Gname.com Pte. Ltd. and is currently taken offline. Infrastructure analysis shows the domain resolves to the IPv6 address 2606:4700:3031::ac43:d75b, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated to the United States. The authoritative nameservers alaric.ns.cloudflare.com and brynne.ns.cloudflare.com further confirm the use of Cloudflare's DNS services. No SSL certificate is associated with the host, indicating the site was served over plain HTTP when active.

VirusTotal reports eight detections out of ninety‑five scanners, reflecting moderate malicious profiling by security vendors. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy feed, suggesting that at least one community‑maintained blocklist has catalogued the indicator. The page title captured from the site reads "Raydium Pro," aligning with the declared brand target of Raydium and the classification of a crypto‑related scam.

Although the site is no longer reachable, the combination of brand impersonation, the "Crypto Scam" label, and the observed infrastructure points to a campaign designed to lure Raydium users into fraudulent interactions. Defenders should add the domain and its associated IPv6 address to network‑level deny lists, monitor for similarly structured subdomains under the raydiumpro‑web.shop second‑level domain, and consider extending existing Cloudflare‑origin block rules to cover the identified nameserver pair. Continuous re‑evaluation of related threat‑intel feeds is recommended to capture any re‑activation attempts or new variants that reuse the same registrar or hosting provider.