raydium-claim[.]web[.]app

This domain, raydium-claim.web.app, is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Raydium brand. The site is hosted on Google Firebase and serves content over HTTPS using a certificate issued by Google Trust Services (WR4). DNS resolution points to IP 199.36.158.100, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States. The page title returned by the server is “RAY NFT – Metaverse”, and the page loads libraries such as Bootstrap, Vue.js, jsDelivr, and jQuery, while enforcing HSTS and supporting HTTP/3. The domain is listed on a single security blocklist and has been flagged by PhishDestroy. VirusTotal analysis shows a single positive detection out of ninety‑five scanners, and the Gridinsoft trust score is 0/100, indicating a lack of confidence in the site’s legitimacy. The infrastructure details, including the use of Firebase and Fastly, are consistent with previously observed crypto‑related impersonation sites, but no additional intelligence about payloads or credential‑harvesting mechanisms is available. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to the associated IP address, and update detection signatures to include the observed page title and technology stack. Continuous re‑evaluation is advised, as further malicious activity may be introduced without notice.