raydium[.]ltd

Analysis of the domain raydium.ltd, observed on 24 July 2026, shows infrastructure consistent with a brand‑impersonation campaign targeting Raydium. The domain is registered through NameSilo, LLC and resolves to the Cloudflare‑owned address 172.67.168.8, located in the United States under ASN 13335 (Cloudflare, Inc.). Both authoritative nameservers, scott.ns.cloudflare.com and gigi.ns.cloudflare.com, belong to Cloudflare, and the TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of reputable CDN and certificate authorities. HTTP probing returned a 403 status and a page title of “Just a moment…”, indicating that the site is currently inaccessible and that the content has not been captured.

The service stack includes Cloudflare edge caching and HTTP/3 support, typical of fast‑flux or CDN‑based hosting used in phishing operations. VirusTotal records indicate that the domain was scanned by 91 security vendors, none of which raised a detection at the time of analysis; this absence should not be interpreted as a validation of safety. The site has been listed on a single security blocklist and was actively blocked by the PhishDestroy feed, confirming that threat‑intelligence providers have identified it as malicious. The campaign is classified as a crypto‑scam, leveraging the Raydium brand to deceive victims, although the exact payload or credential‑harvesting mechanism remains unknown due to the HTTP 403 response.

Defenders are advised to add raydium.ltd and its resolving IP 172.67.168.8 to deny‑list rules, monitor for any re‑registration or DNS changes, and enforce URL filtering for the Raydium brand. Continuous observation of Cloudflare‑hosted domains that reference Raydium in their metadata is recommended, as adversaries may repurpose the same infrastructure for future impersonation attempts.