raydium[.]io-defi-v2[.]com

The domain raydium.io-defi-v2.com is a confirmed phishing site engaged in brand impersonation targeting Raydium, a cryptocurrency platform. It was designed to deceive users into believing they were interacting with the legitimate Raydium service, likely to steal credentials or funds through cryptocurrency scams. No drainer kit was identified, but the site has since been taken offline.

Technical analysis shows that raydium.io-defi-v2.com was flagged by 2 of 95 VirusTotal security vendors, including alphaMountain.ai and Fortinet. It appeared on 2 security blocklists, PhishDestroy and ScamSniffer, and had a Gridinsoft trust score of 0/100. The domain was registered through Hello Internet Corp on February 21, 2026, and resolved to the IPv6 address 2606:4700:3030::6815:2001, hosted by Cloudflare, Inc. in the US. The SSL certificate was issued by WE1, and the observed page title was '403 Forbidden'. Nameservers for the domain were ns100.webnic.cc and ns101.webnic.cc.

Users who interacted with raydium.io-defi-v2.com should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. If credentials were entered, change passwords on the legitimate Raydium platform and enable two-factor authentication. Monitor accounts for unauthorized transactions and report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand’s security team for further action.