raydium[.]us

The domain raydium.us is a confirmed phishing site engaged in brand impersonation targeting Raydium, a decentralized finance platform. It presents itself as a legitimate Raydium interface under the page title 'Swap Raydium' but is designed to facilitate wallet_connect_phish scams, tricking users into connecting wallets to malicious smart contracts. No drainer kit was identified, and the site is currently taken offline.

Technical analysis shows raydium.us was flagged by 1 of 95 VirusTotal security vendors, including Kaspersky, though Google Safe Browsing did not detect it. The domain appears on 1 security blocklist, PhishDestroy, and was registered on August 19, 2025, through Web Commerce Communications Limited. It resolves to IP address 185.125.50.183, hosted in Germany under AS215730 H2NEXUS LTD, with nameservers tori.ns.cloudflare.com and yisroel.ns.cloudflare.com. No SSL certificate was issued for the domain.

Users who interacted with raydium.us should immediately revoke any token approvals granted to unknown contracts via a wallet revoke tool. Transfer remaining funds to a new, secure wallet and monitor transaction history for unauthorized activity. Report the domain to the impersonated brand, Raydium, and submit it to anti-phishing platforms such as PhishTank or Google Safe Browsing. Enable two-factor authentication on all accounts and remain vigilant for follow-up phishing attempts.