rewards[.]raydium-perps[.]com

Analysis of the domain rewards.raydium-perps.com indicates it was actively used for brand impersonation targeting Raydium, a known cryptocurrency platform. The domain, registered on September 9, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, resolved to the IP address 172.67.159.20, hosted on Cloudflare's infrastructure (AS13335) in the United States. At the time of assessment, the domain was offline, returning a 404 Not Found HTTP status, and no SSL certificate was present, which is atypical for legitimate financial or crypto-related services. Infrastructure analysis reveals the domain was flagged by one security vendor on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy.

Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The nameservers, duke.ns.cloudflare.com and emma.ns.cloudflare.com, are consistent with Cloudflare's DNS infrastructure, a common choice for both legitimate services and threat actors due to its privacy and protection features. The scam type is explicitly categorized as a crypto scam, aligning with the impersonation of Raydium. However, the exact mechanics of the scam—such as whether it involved fake token giveaways, phishing for wallet credentials, or other fraudulent schemes—remain unclear due to the domain's current offline status and lack of accessible content.

No additional details about the phishing kit, backend infrastructure, or associated threat actors are available from the provided evidence. Defenders should treat this domain as high-risk for crypto-related fraud. Recommended actions include blocking the domain and its resolving IP at the network level, monitoring for any re-emergence or related domains, and alerting users to the potential threat. Given the domain's registration age and its presence on blocklists, it is unlikely to be a false positive, though further investigation into its historical activity may provide additional context.