portfolio-rayapi[.]click

portfolio-rayapi.click was registered on 21 February 2026 and later pointed to the IP address 188.114.96.3, which belongs to Cloudflare Inc. (AS13335) and is geolocated in the United States. The site presented a page title of “Raydium”, matching the targeted brand Raydium, and was classified as a crypto‑scam impersonation. An SSL certificate identified as “WE1” was observed, but no further certificate details were disclosed. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating a malicious reputation.

The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, confirming prior detection by anti‑phishing services. VirusTotal analysis recorded five positive detections out of ninety‑five scanned vendors, reinforcing the malicious assessment. The site is currently marked as offline, and no active HTTP response was retrieved at the time of analysis. Observed indicators suggest the infrastructure is leveraged to lure victims into a fraudulent Raydium‑related workflow, likely aiming to harvest cryptocurrency credentials or funds.

Uncertainty remains regarding the exact payload or page content, as the site was not reachable for content inspection and no screenshots or code samples are available. Defenders should block the domain and its associated IP at network perimeters, monitor for DNS queries to the hostname, and add the address to local threat intelligence feeds. Continuous re‑probing of the domain is advised in case the site is re‑activated, and any future VirusTotal or sandbox submissions should be correlated with the existing five vendor detections. Organizations using Raydium services should educate users about unsolicited requests referencing Raydium and enforce multi‑factor authentication to mitigate credential compromise.