raydiumm-en[.]framer[.]ai

On 25 July 2026 analysts reviewed the domain raydiumm-en.framer.ai, which is classified as a brand‑impersonation vector targeting the Raydium cryptocurrency platform. The domain was registered on 4 April 2023 through CSC Corporate Domains, Inc., and resolves to the Amazon‑owned address 35.71.142.77 (AS16509, United States). DNS resolution uses four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). TLS termination is provided by a Let’s Encrypt certificate (Issuer E8), and the site advertises HSTS and HTTP/3 support, with underlying technologies identified as Framer Sites and React. An HTTP request returns a 404 status and the page title "Site Not Found | Framer", indicating that the site is currently offline, yet historical activity confirms malicious intent.

Threat intelligence shows that eight of ninety‑three VirusTotal scanners flagged the domain, and the domain appears on three independent security blocklists. Specific blocklist operators that have listed the domain include PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of a crypto‑scam campaign. The impersonation claim is supported by the explicit reference to Raydium in the intelligence file and the classification as a crypto scam.

While the current HTTP response is a not‑found page, the presence of a valid SSL certificate and the previously observed malicious detections suggest that the infrastructure may be reused for future fraudulent pages. Uncertainty remains regarding any active phishing landing pages, credential‑harvesting forms, or transaction‑draining scripts, as no content was captured before the site went offline.

Defenders should continue to block the domain and associated IP address at network perimeters, update endpoint and browser protections with the identified blocklist entries, and monitor the AWS name‑server set for any new sub‑domains that may resolve to the same IP.