raydiun[.]fit

PhishDestroy identifies raydiun.fit as an active brand-impersonation domain impersonating Raydium, currently pushing a crypto-drainer kit disguised as a staking interface. The landing page title reads Raydium Staking, creating a false sense of legitimacy for Solana users seeking yield opportunities. No custom drainer kit hash has been extracted yet, but the page clearly mimics Raydium’s branding and staking workflow. This domain was flagged on 2026-03-02 and resolves to IP 172.67.173.25 via a Let’s Encrypt SSL certificate issued by NAMECHEAP INC. VirusTotal scanning shows 0 detections out of 95 engines as of the latest check, indicating it remains undetected by most antivirus platforms. Google Safe Browsing has not yet blacklisted the domain, and no public blocklists currently include it. The domain’s age is extremely low, suggesting a fast-turnover campaign designed to evade detection. As of this report, raydiun.fit remains active and accessible. PhishDestroy has issued an internal IOC feed entry and coordinated with the Raydium security team to escalate takedown requests to hosting providers and registrars. Despite these actions, the risk level remains under investigation due to the domain’s recent creation and low detection coverage. Users are strongly advised to verify all staking links via Raydium’s official website or PhishDestroy’s threat portal before connecting wallets or entering credentials.