raydex-dcr[.]pages[.]dev

The domain raydex-dcr.pages.dev was registered on 31 March 2026 through Cloudflare, Inc. and is serviced by the Cloudflare name servers malcolm.ns.cloudflare.com and megan.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to Cloudflare infrastructure located in Canada. The site presents an HTTPS certificate issued by Google Trust Services (WE1), and the TLS configuration includes HSTS and HTTP/3 support. Front‑end analysis shows the presence of AngularJS, indicating a modern JavaScript framework commonly used in phishing kits. The page title returned by the server is “Raydium Airdrop Claim”, matching the declared brand target Raydium and the classified scam type “Fake Airdrop”. The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that it is recognized as malicious by multiple vendors. Gridinsoft assigns a trust score of 0/100, and the overall risk rating is high. The campaign remains active as of the report date (12 July 2026). At present, no additional infrastructure such as secondary IPs, C‑NAME chains, or associated malware samples have been publicly disclosed. Defenders should block the domain and the associated IP address at network perimeter, monitor for any DNS queries to the Cloudflare name servers, and consider adding the domain to endpoint and email filtering rules. Ongoing observation of the IP reputation and any future detections is advised.