956b52c2ecf347d6[.]raydiumpro-web[.]shop

On 24 July 2026 the domain 956b52c2ecf347d6.raydiumpro-web.shop was observed to be offline but retains a footprint indicative of a high‑risk brand‑impersonation campaign targeting Raydium. The domain was registered on 15 October 2025 through Gname.com Pte. Ltd. and is hosted behind Cloudflare’s network (ASN 13335) with the IP address 104.21.86.58 located in the United States. DNS resolution is served by alaric.ns.cloudflare.com and brynne.ns.cloudflare.com, confirming the use of Cloudflare’s authoritative name‑servers. No TLS certificate was presented, meaning the site would have been reachable only over HTTP, a common tactic to avoid certificate‑pinning checks.

The page title returned during the brief live period was “Raydium Pro”, matching the declared brand target Raydium and the listed scam type “Crypto Scam”. Google Safe Browsing classified the URL as social engineering, and VirusTotal recorded ten detections out of ninety‑five scanners, indicating that multiple security vendors identified malicious characteristics. The domain also appears on a single external blocklist and was listed by PhishDestroy as a blocked resource. Evidence suggests the operator intended to lure Raydium users into a fraudulent cryptocurrency workflow, although the exact payload or credential‑capture mechanism has not been captured.

Because the site is currently offline, active traffic cannot be measured, and the specific malicious infrastructure remains unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same host header or similar sub‑domains, and update detection rules to flag the exact page title “Raydium Pro”. Incident response teams should also advise Raydium community members to disregard any unsolicited communications referencing “Raydium Pro” and to verify URLs against the official Raydium domain.