ray-diun[.]cfd

Analysis of ray-diun.cfd indicates that the domain was created on April 20, 2026 and is currently taken offline. The domain resolves to IP address 104.21.76.10, which is hosted by Cloudflare (AS13335) and located in the United States. Registration was performed through Dynadot Inc, and the authoritative nameservers are celeste.ns.cloudflare.com and kareem.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site presented the page title "Just a moment..." and served an SSL certificate issued by Let’s Encrypt (identifier YE2), a commonplace certificate that does not convey any intrinsic trust.

Threat intelligence shows a Gridinsoft trust score of 0 out of 100, indicating a lack of reputation. The domain appears in one AlienVault OTX pulse and has been flagged by two of ninety‑one VirusTotal scanners, reflecting limited but non‑trivial detection by security vendors. It is listed on four security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, reinforcing the view that it is regarded as malicious.

The campaign is categorized as brand impersonation targeting the Raydium brand, aligning with the stated scam type. While the page content beyond the title has not been publicly examined, the convergence of registrar details, Cloudflare hosting, low trust score, multiple blocklist entries, and vendor detections collectively support the conclusion that ray-diun.cfd was employed for a Raydium‑related brand‑impersonation operation. Defenders should continue to block the domain across perimeter and endpoint controls, monitor for any re‑use of the same infrastructure, and advise users to avoid interacting with any URLs containing this domain, especially in cryptocurrency‑related contexts.