api[.]raydlium[.]xyz

The domain api.raydlium.xyz was identified as a phishing site involved in brand impersonation, specifically targeting users of Raydium, a cryptocurrency platform. This domain attempted to present itself as a legitimate Raydium service, as indicated by the page title 'Raydium Staking'. The site is currently taken offline and is not safe to use. Users searching for information about api.raydlium.xyz should be aware that it has been flagged for phishing activity and brand impersonation.

Technical analysis shows that api.raydlium.xyz was registered through Dynadot LLC on February 21, 2026, and resolves to the IP address 172.67.147.216, located in the US under AS13335 Cloudflare, Inc. The domain is listed on two security blocklists—PhishDestroy and ScamSniffer—and 2 of 95 vendors on VirusTotal (including Forcepoint ThreatSeeker and SOCRadar) have detected it as malicious. Google Safe Browsing has not flagged the domain. The domain does not have an SSL certificate and uses Cloudflare nameservers (apollo.ns.cloudflare.com and meera.ns.cloudflare.com).

Anyone who interacted with api.raydlium.xyz or entered wallet credentials should immediately change passwords, enable two-factor authentication, and closely monitor associated accounts for fraudulent activity. Since this is a cryptocurrency-related phishing scam, users should also consider moving assets to a new wallet and revoking any token approvals linked to the compromised address. Suspicious domains like api.raydlium.xyz can be reported to security providers or through anti-phishing organizations for further investigation.