wallet-raydium-en[.]pages[.]dev

The domain wallet-raydium-en.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which is associated with AS13335 (Cloudflare) and located in the United States. An SSL certificate issued by Google Trust Services (label WE1) secures the site, and the authoritative nameservers are destiny.ns.cloudflare.com and rajeev.ns.cloudflare.com. The page title returned by the server is “Raydium Wallet – Secure RAY Token Storage | Solana DeFi Guide,” indicating an attempt to masquerade as a legitimate Raydium wallet interface. Google Safe Browsing classifies the URL as social engineering, and Gridinsoft assigns a trust score of 0 out of 100.

The domain appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. HTTP responses return a 403 status code, and the site is currently taken offline. VirusTotal analysis shows that nine of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious activity.

The threat is identified as a brand impersonation targeting Near users, specifically a wallet/seed phishing campaign. Defenders should ensure that any inbound traffic to this domain is denied, update detection signatures to include the domain and its associated IP, and monitor for any residual attempts to resolve the hostname. Continuous observation of Cloudflare‑registered domains with similar naming patterns is advisable, as they may be used in future impersonation attempts.