raydlium[.]pro

The domain raydlium.pro is identified as a brand-impersonation threat specifically targeting Raydium, a decentralized finance platform. Analysis confirms this domain hosts a fraudulent staking interface titled "Raydium Staking," designed to deceive users into submitting credentials or transferring assets under false pretenses. As of the latest verification, the domain has been taken offline, though prior activity and infrastructure details remain relevant for security assessments. Infrastructure analysis reveals critical technical indicators. The domain was registered on January 31, 2026, through Dynadot Inc, a registrar commonly utilized for both legitimate and malicious registrations. It resolves to the IP address 104.21.89.254, which may be associated with content delivery networks or other shared hosting environments. Notably, raydlium.pro lacks an SSL certificate, increasing the risk of interception or manipulation of user data. Security vendors have flagged the domain, with 1 out of 95 VirusTotal engines detecting malicious activity. Additionally, the domain appears on three distinct security blocklists, further corroborating its association with phishing or fraudulent operations. Current status indicates the domain is offline, reducing immediate exposure risk. However, historical data and infrastructure patterns suggest potential for re-emergence or reuse of similar domains. Organizations and users are advised to implement the following measures: block the domain and associated IP address at the network perimeter, monitor for newly registered domains with similar naming conventions, and educate users on recognizing brand-impersonation tactics. Security teams should also review logs for prior interactions with raydlium.pro to assess potential compromise. Proactive monitoring of registrar activity and blocklist updates is recommended to mitigate future threats from this actor or associated infrastructure.