raydium[.]co[.]com

raydium.co.com is currently listed as an offline domain that was used to impersonate the Raydium brand in a crypto‑scam campaign. The site returned the page title “Nur einen Moment…”, which does not contain any brand references, and it lacked an SSL certificate, indicating the connection was unencrypted. DNS resolution pointed to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The authoritative name servers are raquel.ns.cloudflare.com and rohin.ns.cloudflare.com, both Cloudflare‑managed, which is typical for fast‑flux or abuse‑resilient infrastructure.

Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence level. VirusTotal recorded nine detections out of ninety‑five scanned vendors, confirming that multiple security products flagged the domain as malicious. The domain appears on two independent blocklists—PhishDestroy and ScamSniffer—and is explicitly categorized as a crypto scam that masquerades as Raydium. Because the site is presently taken offline, active exploitation is unlikely, but the underlying IP address remains in use by Cloudflare and could be recycled for other malicious campaigns.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration of the exact name or variations, and add the associated IP address to any network‑wide deny lists pending further verification. Continuous observation of Cloudflare‑hosted IP ranges for new Raydium‑related indicators is recommended, as well as periodic re‑scanning with multi‑engine services to capture any changes in detection status. Organizations that interact with Raydium services should educate users that the legitimate Raydium platform does not host domains under the “.co.com” suffix and that any request for cryptocurrency transactions from such URLs should be treated as suspicious.