raydium-swp[.]at

The domain raydium-swp.at is currently active and returns an HTTP 301 redirect. DNS resolution points to the IPv4 address 209.74.82.247, hosted in Singapore under AS22612 (Namecheap, Inc.). The server presents a Let’s Encrypt certificate issued to YR2 and runs Nginx. The page title reported by crawlers is “Raydium Swap | Solana AMM — $1T Cumulative Volume, Deep Native Liquidity”, indicating an attempt to impersonate the Raydium decentralized exchange. VirusTotal scans show 2 of 91 security vendors flag the domain as malicious. Independent intelligence places the domain on three public blocklists and assigns a Gridinsoft trust score of 0/100. The site is classified as a crypto drainer, and it is listed as blocked by PhishDestroy, MetaMask, and SEAL. Registration occurred through Hosting concepts B.V. via the .at registrar, with authoritative nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com. At present no additional payload or page content has been disclosed, so the exact phishing workflow remains unknown. Defenders should block the domain and its resolved IP, monitor DNS queries for the associated nameservers, and consider adding the indicator set to intrusion detection and web filtering policies. Continuous re‑evaluation is advised as further analysis may reveal additional malicious components.