swaap-raydium-en-us[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat designed to deceive users within the cryptocurrency ecosystem. Analysis indicates the site mimics Raydium Swap, a legitimate decentralized trading platform on Solana, by replicating its interface and branding. The intent is likely to trick users into connecting wallets or approving malicious transactions, potentially leading to unauthorized fund transfers or exposure of sensitive credentials. Such impersonation attacks often serve as crypto drainers, siphoning assets from victims' wallets once permissions are granted. Infrastructure analysis reveals multiple red flags confirming the malicious nature of this domain. The domain was registered on February 21, 2026, an unusual future date that suggests domain spoofing or registry manipulation. It resolves to the IP address 172.66.47.120 and is hosted through Cloudflare, Inc., a common tactic to obscure the true origin of malicious infrastructure. Security vendors on VirusTotal have flagged this domain, with 10 out of 95 engines detecting it as malicious. Additionally, the domain appears on three security blocklists and has been blocked by MetaMask, SEAL, and PhishDestroy, further validating its high-risk status. The SSL certificate is issued by Google Trust Services, which does not mitigate the threat but provides a false sense of legitimacy. Users who visited swaap-raydium-en-us.pages.dev should take immediate action to secure their assets and accounts. First, disconnect any wallets or accounts linked to the site and revoke all permissions granted to unknown or suspicious smart contracts using tools like Etherscan or Solana explorer. Monitor connected wallets for unauthorized transactions and transfer assets to a new, secure wallet if compromise is suspected. Enable transaction simulation tools to preview the outcome of any blockchain interaction before approval. Report the domain to relevant security platforms and blocklists to prevent further victimization. If credentials or private keys were entered, consider the affected accounts compromised and take steps to secure all associated assets.