Is relaysystems.xyz safe? TrustSniffer's low-trust assessment: 40/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a single landing page presented under the Raydium name. It describes itself as a Solana-based decentralized exchange and liquidity protocol, with token swaps, liquidity pools and farms, yield through fees, and a launchpad for new Solana projects. The page also shows headline totals for locked value and cumulative trading volume. It is served from the unrelated, newly registered domain relaysystems.xyz and is built around wallet-connection calls to action. Its apparent business model is fee income from swaps and liquidity pools, plus token-launch services.

Scam/Impersonation Risk

Confirmed contradictory signals are present. An external threat-intelligence listing flags the domain, which amounts to a confirmed blacklist hit. Independent reputation checks found the domain malicious or suspicious, and the platform's archive intelligence also carries a known-phishing indicator for it. No conflicting legal identities were found. The behavioral analysis did not detect wallet-drainer activity, clipboard hijacking, hidden forms or cloaking. The page's displayed content is therefore not itself proven malicious, but the reputation findings are decisive for risk posture. The homepage presents itself as Raydium, yet nothing independently ties this domain to that brand. The domain is only about two weeks old and bears no relation to the brand name. Automated analysis did not classify this as confirmed brand impersonation. However, a brand-styled page on an unconnected, freshly registered domain is a recognised pattern for lookalike deployments, and the pairing with a threat listing keeps that possibility open. The page's calls to action reinforce the concern. These include "Connect Wallet", "Claim Airdrop", "Rectification", "Claim fees and Claim farms" and "Validate liquidity and any SPL token". Prompts of this kind are routinely used to steer visitors into signing malicious wallet transactions. The page also displays a locked-value total of roughly $3.17 billion and cumulative trading volume of roughly $811 billion. These are unverifiable counters on a domain with no operating history, and they borrow the credibility of a long-established protocol. Evidence:

• Homepage: titled "Raydium" and described as a Solana AMM/DEX, but served from relaysystems.xyz, a domain with no demonstrated link to that brand.
• Homepage: the headline counters for total value locked (about $3.17B) and total trading volume (about $811.5B) are not backed by any on-page source.
• Homepage: airdrop-claim, "Rectification" and claim-farms prompts sit alongside "Connect Wallet".
• Domain registered 2026-10-06 (about two weeks old, 0.04 years). The web archive holds 1 snapshot, dated 2026, so there is no multi-year history.

Regulatory Verification Notes

The homepage names no legal entity, operator, jurisdiction, licence, or registration number. It carries no audit reference, governance link or risk disclosure, so the operator cannot be independently connected to any real-world person or company. The platform's classification of the site as an established, legitimate DeFi protocol rests on page content alone. That classification is outweighed by the threat listing and the very recent registration. No third-party broker or regulatory-database match was found, so no external reputational signal exists on the regulatory side. Apparent technical hygiene, namely a valid certificate and consistent page behaviour, is normal for freshly deployed sites and is not evidence of legitimacy. The domain's registration details are incomplete, which aligns with the lack of any identifiable operator. Evidence:

• Homepage: no company name, licence number, registry reference, audit report or governance documentation appears in the supplied page text.
• Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, created 2026-10-06 and expiring 2027-10-06.
• TLS certificate issued by YE1 (DV, domain validation only), valid to 2027-01-04, so identity of the operator is not vetted by the certificate.
• Served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any wallet interaction, the real Raydium protocol's official domain should be confirmed through an independent route. Suitable routes are the project's verified social accounts, official documentation, or a reputable DeFi aggregator, not links from this site. The address in the browser bar should be compared character by character against that official domain. If the destination differs, the site should be treated as a lookalike. Any wallet that has already been connected here should have its token approvals reviewed and revoked with a reputable approvals tool. Official support channels should be confirmed through those same independent sources, not through anything published on this site. Evidence:

• Homepage: the brand is presented without any link to a verifiable official source or audit.
• Domain age and archive history: a registration only two weeks old and a single archive capture give no track record to rely on.
• Homepage: the airdrop-claim and "Rectification" prompts are the actions most worth checking against the official project.

Summary Verdict

Available evidence supports an elevated-risk posture. A confirmed external threat listing combines with a newly created domain, an unverified operator and brand-styled content that cannot be tied to the protocol it names. Isolated technical findings are benign, and no drainer behaviour was observed. These do not offset the reputation findings, and the identity of the operator remains unverified.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four observed addresses are edge nodes. The origin server was not observable. This protection is a mitigating factor only, because it neither validates the operator nor offsets the external threat detection. It also limits independent hosting verification and can mask rapid content changes. The domain's sparse subdomain footprint at this early age is an unconfirmed heuristic, not a confirmed risk.

Closing Assessment

At most, the site should be viewed read-only. No wallet should be connected, no transaction signed, no airdrop or farm claimed, and no credentials or funds committed through this domain. Anyone seeking the Raydium protocol should reach it only via independently verified official channels.