raydum-swap[.]com

This domain, raydum-swap.com, is flagged as an active high-risk crypto scam impersonating Raydium, a known decentralized finance platform. Registered on February 21, 2026, through NamePal.com #8025, LLC, the domain currently resolves with an HTTP 200 status, indicating operational infrastructure. Analysis of its nameservers reveals a mix of standard (ns1.afternic.com, ns2.afternic.com) and a verification-specific nameserver (verification-d3jclucsp89ganyqbydeny.ns), which may suggest an attempt to bypass detection mechanisms or maintain redundancy. The page title, www.www.raydum-swap.com, deviates from typical Raydium branding, potentially serving as an indicator of compromise for automated detection systems. The domain appears on one security blocklist (PhishDestroy) and is flagged by 2 of 93 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in available intelligence. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. While the exact content of the site remains unanalyzed, the combination of brand impersonation, crypto scam classification, and infrastructure anomalies (e.g., atypical nameserver configuration) warrants immediate defensive action. Defenders should prioritize blocking this domain at the DNS and network layers, particularly in environments handling cryptocurrency transactions or decentralized finance operations. Monitoring for connections to the listed nameservers may also aid in identifying related infrastructure. Given the domain's recent registration and active status, continuous monitoring for changes in hosting, nameserver assignments, or additional blocklist inclusions is recommended. No evidence currently links this domain to a specific phishing kit or broader campaign, so correlation with other indicators should be conducted to assess potential ties to larger threat clusters.