raydium-io[.]co

PhishDestroy identifies raydium-io.co as an active brand impersonation domain targeting Raydium users. This malicious domain mimics the legitimate Raydium platform to deceive visitors and harvest credentials or sensitive data.

This domain was flagged with a risk level of under_investigation and exhibits multiple red flags: it resolves to IP 172.67.176.46, was registered on March 29, 2026, and carries a valid Let’s Encrypt SSL certificate. The domain is hosted via Web Commerce Communications Limited (WebNic.cc) and currently shows 3/95 detections on VirusTotal, suggesting it remains under the radar of most security vendors. As of this assessment, the domain has not been identified on major blocklists or threat intelligence feeds, further complicating early detection efforts.

Immediate mitigation steps are advised to prevent potential compromise. Organizations should block raydium-io.co at the firewall and DNS level to prevent users from accessing the malicious site. Users should be warned about the domain and advised to access Raydium only through verified official channels. Additionally, implementing enhanced monitoring for traffic to newly registered or recently active domains resembling Raydium is recommended to detect similar impersonation attempts promptly.