fasset[.]cc

This domain, fasset.cc, was registered on 21 February 2026 through Dynadot LLC and is presently taken offline. The site presented a page titled “Swap Raydium”, indicating an attempt to impersonate the Raydium decentralized exchange platform. The SSL certificate presented as “WE1”, issued by Cloudflare, and the host resolves to 172.67.146.5, an address owned by Cloudflare, Inc. in Canada. Technical fingerprinting shows the front‑end stack is built on Node.js with Vue.js and Nuxt.js, and the traffic is served over HTTP/3 with Cloudflare Browser Insights enabled, consistent with a modern web‑app deployment.

VirusTotal analysis recorded six positive detections out of ninety‑three scanners, and the domain is listed on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. The blocklist entries categorize the activity as a crypto‑scam, matching the observed “Swap Raydium” title. No additional content was captured before the takedown, so the exact payload, credential‑capture mechanisms, or wallet‑drainage logic remain unknown.

Defenders should continue to block resolution of fasset.cc at the DNS level and incorporate the IP 172.67.146.5 into network‑wide deny lists, recognizing that the address is shared by Cloudflare and may host legitimate services. Monitoring of newly issued certificates for the “WE1” issuer and of domains registered through Dynadot LLC for similar Raydium‑related keywords is recommended. Threat‑intel feeds should be updated to reflect the confirmed impersonation of Raydium and the associated crypto‑scam classification, enabling endpoint and browser security solutions to flag any future re‑use of the same infrastructure.