raydiumi[.]com

The domain raydiumi.com was registered on March 28, 2025 through Web Commerce Communications Limited. The authoritative name server count is one, and the domain resolves to the IPv4 address 78.159.156.221, which belongs to AS25211 Euro Crypt EOOD located in the Netherlands. No TLS certificate was observed, indicating that the site was served over plain HTTP at the time of collection. Public threat intelligence records show the domain appearing in a single AlienVault OTX pulse and being listed on three independent blocklists.

Antivirus and URL scanning services on VirusTotal flagged the domain by five of ninety‑five vendors, providing an early indication of malicious intent. The site was explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, further confirming its classification as a phishing vector. The page title retrieved from the live host was “Swap Raydium”, matching the advertised brand target Raydium and confirming a brand‑impersonation tactic aimed at cryptocurrency users. The current operational status is offline, which limits direct observation of the page content; consequently, the precise phishing workflow, such as credential or seed capture mechanisms, remains unknown.

Defenders should continue to enforce domain‑level blocking for raydiumi.com across DNS and web filtering solutions, monitor the associated IP address for any re‑use, and consider adding the domain to internal blocklists. Additional scrutiny of traffic to AS25211 may reveal related infrastructure. Ongoing threat‑intel feeds should be consulted for any resurgence of the domain or related indicators of compromise.