ray-diun[.]lol

The domain ray-diun.lol was registered through Dynadot Inc on April 20, 2026. It resolves to the Cloudflare‑owned address 172.67.149.100, which is advertised as located in the United States and belongs to AS13335 (Cloudflare, Inc.). The authoritative nameservers are celeste.ns.cloudflare.com and kareem.ns.cloudflare.com, indicating the domain is fully hosted behind Cloudflare’s edge network. TLS is provided by a Let’s Encrypt certificate identified as “YE2”, which is typical for short‑lived certificates and does not provide any brand‑specific validation. The only visible HTTP response captured before the site was taken offline returned the page title “Just a moment…”, a generic placeholder often used by Cloudflare’s challenge page.

No further content has been observed, and the current status is reported as offline, so active payload delivery cannot be confirmed at this time. Reputation services have flagged the domain. VirusTotal reports that 2 of 91 scanning engines have marked the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of confidence. The domain appears on four public blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—and is listed in a single AlienVault OTX pulse.

These listings collectively identify the domain as a brand‑impersonation attempt targeting Raydium. Because the domain is already listed on multiple blocklists and has a low trust score, defenders should add ray‑diun.lol to internal deny lists, enforce DNS‑level blocking, and monitor for any future resolution changes. Continuous re‑resolution checks are advised, as Cloudflare‑based infrastructure can be repointed rapidly. Logging of any attempted connections to the 172.67.149.100 address should be correlated with user activity to detect possible phishing attempts aimed at Raydium users. Until the site is definitively taken down, network‑level controls remain the most effective mitigation.