raydium-io[.]to

This domain, raydium-io.to, was registered on 2025-10-02 through the Government of the Kingdom of Tonga and is hosted on Cloudflare infrastructure (IP 172.67.141.160, AS13335, United States). DNS resolution uses the Cloudflare nameservers frank.ns.cloudflare.com and yolanda.ns.cloudflare.com. The web server presents an Nginx/OpenResty stack with jQuery and serves a page titled "Swap Raydium | Solana" over a valid Let's Encrypt certificate (issuer E8). HTTP response code is 200. The site is classified as a high‑risk cryptocurrency brand‑impersonation campaign targeting Raydium users. It appears on seven security blocklists and has been cited in sixteen AlienVault OTX pulses. Gridinsoft assigns a trust score of 0/100. VirusTotal reports 17 of 95 scanners flagging the domain. Multiple protective products—including PhishDestroy, MetaMask, SEAL, Polkadot and Enkrypt—have blocked the domain. The activity is currently active. While the exact malicious payload has not been disclosed, the combination of blocklist presence, low trust score, and multiple vendor detections indicates a high probability of credential or asset theft. Defenders should block the domain at network perimeter, monitor DNS queries for the domain and associated IP, and advise users to avoid any interactions with URLs matching this pattern. Further investigation should focus on capturing any outgoing traffic from compromised browsers to identify potential command‑and‑control endpoints.