reward-ray[.]app

reward-ray.app is flagged as a high‑risk brand‑impersonation infrastructure targeting Raydium. The domain was registered on 2026-04-02 through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active. DNS resolution points to 172.67.150.119, a Cloudflare address located in Canada, and the authoritative nameservers are edna.ns.cloudflare.com and kevin.ns.cloudflare.com. The site serves an SSL certificate issued by Let’s Encrypt (E7) and returns HTTP 521, indicating that the origin server is unavailable. The page title observed is "Raydium Rewards", confirming the intent to masquerade as a Raydium offering. Intelligence sources report the domain appears on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX lists the domain in eight threat‑intel pulses, while Gridinsoft assigns a trust score of 0/100. No additional technical artifacts such as malware hashes or payloads have been disclosed, and the content of the landing page has not been publicly analyzed. Defenders should block the domain at DNS and network layers, monitor for connections to the associated Cloudflare IP, and update detection rules to include the observed page title and the specific nameserver pair. Ongoing observation is recommended to capture any future changes to the hosting or content.