io-raydiumwallet[.]pages[.]dev

PhishDestroy identifies io-raydiumwallet.pages.dev as a confirmed phishing site that specifically impersonates the Ledger brand. This domain is currently offline, but while active it posed a significant threat to cryptocurrency users by attempting to steal sensitive information such as wallet credentials and private keys. The site was designed to look like a legitimate Ledger interface, tricking users into believing they were managing their DeFi assets on Solana.

Technical indicators reveal that this domain was created on September 10, 2025, and resolved to IP address 172.66.47.33. It was registered through Cloudflare, Inc. and secured with an SSL certificate from Google Trust Services. Security analysis from VirusTotal shows that 3 out of 95 security vendors flagged this domain as malicious, and it appears on 3 separate security blocklists. Despite the low detection rate, the combination of brand impersonation and recent registration strongly suggests malicious intent.

Given that the site is now offline, the immediate risk is reduced; however, users should remain vigilant. Anyone who may have interacted with this domain should immediately change their Ledger-related passwords and enable two-factor authentication. It is also advisable to monitor accounts for unauthorized activity and avoid clicking on unsolicited links claiming to be from cryptocurrency wallet providers. PhishDestroy recommends always verifying URLs directly through official sources and using hardware wallets with caution against phishing attempts.