swap-raydium-io[.]pages[.]dev

The domain swap-raydium-io.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Raydium, a cryptocurrency platform. It was designed to deceive users into believing they were interacting with the legitimate Raydium service, posing an elevated risk of cryptocurrency theft through fraudulent transactions or credential harvesting. No drainer kit was identified, but the site has since been taken offline.

Technical indicators confirm the malicious nature of swap-raydium-io.pages.dev. The domain was flagged by 3 of 95 security vendors on VirusTotal, including ChainPatrol, alphaMountain.ai, and Fortinet. It appears on three security blocklists: PhishDestroy, MetaMask, and SEAL. Registered through Cloudflare, Inc. on September 10, 2025, the domain resolved to the IP address 172.66.44.181, hosted by Cloudflare in the US. The SSL certificate was issued by Google Trust Services / WE1, and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with an HTTP status of 403 at the time of assessment. Gridinsoft assigned a trust score of 0/100.

Users who interacted with swap-raydium-io.pages.dev should immediately revoke any token approvals granted to suspicious contracts and transfer funds to a new wallet to prevent unauthorized access. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand’s official security team to aid in takedown efforts and protect other potential victims.