# PhishDestroy domain threat record: myatomicwallet.readme.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/myatomicwallet.readme.io/ Machine-readable companion: https://phishdestroy.io/domain/myatomicwallet.readme.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-17 13:25:28 UTC - Last availability or vendor check: 2026-10-22 10:29:48 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 3/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Atomic Wallet ## Stored infrastructure - Observed IP address: 104.16.241.118 - Registrar in stored WHOIS data: 1API GmbH - Last stored HTTP status: 302 - Registration date (registry RDAP, readme.io): 2011-05-17 10:06:31 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/myatomicwallet.readme.io - Certificate Transparency search: https://crt.sh/?q=%25.myatomicwallet.readme.io - Web Archive lookup: https://web.archive.org/web/*/https://myatomicwallet.readme.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview myatomicwallet.readme.io is a phishing page that impersonates Atomic Wallet, the non-custodial multi-coin crypto wallet. It runs on a subdomain of ReadMe, a documentation-hosting service, so the address borrows a legitimate parent domain while presenting itself under the page title "myatomicwallet". PhishDestroy first flagged it on 2026-09-17. As of 2026-10-19 the site was still alive and redirecting visitors elsewhere. How the scam works Atomic Wallet users hold their own keys, so there is no account password to steal. Pages like this one try to obtain the 12-word recovery phrase or private key instead, usually through fake "restore", "sync" or "support" prompts, or they push a counterfeit wallet download. Once the phrase is entered, the attacker can rebuild the wallet on their own device and move every asset out. These transfers cannot be reversed. The redirect means the readme.io address works as a disposable front door that forwards victims to wherever the operator currently hosts the lure. Evidence Independent detection is thin. On 2026-10-01 only 3 of 91 VirusTotal engines flagged the address: CRDF, Forcepoint ThreatSeeker and VIPRE. PhishDestroy is the only blocklist carrying it so far. Most browsers and security tools will therefore not warn a visitor. The classification rests on the brand impersonation itself, not on vendor consensus. Infrastructure The address resolves to 104.16.241.118 on Cloudflare's network, geolocated to Canada. That is the edge serving the ReadMe platform, not hardware the operator controls. Free subdomains on reputable documentation services are popular with phishers because they inherit the parent domain's reputation and cost nothing to replace when one is taken down. The operator never had to register a domain at all. What to do If you typed your Atomic Wallet recovery phrase or private key anywhere after landing here, treat the wallet as compromised. Create a new wallet with a fresh phrase on a device you trust, and move any remaining funds to it immediately. If you installed software from this page, uninstall it, scan the device, and assume any wallet on that machine is exposed. Atomic Wallet never asks for your phrase through a website, and real support staff will never request it. Defenders should block the full subdomain, watch for other Atomic-themed subdomains on ReadMe and similar documentation hosts, and report the page to ReadMe for removal. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/myatomicwallet.readme.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=myatomicwallet.readme.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:40:53 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/585876de-3a78-40c1-a4cf-76ebed064bb7.png Captured: 2026-09-25 05:02:39 UTC Source report: https://radar.cloudflare.com/scan/585876de-3a78-40c1-a4cf-76ebed064bb7 SHA-256: de1287521a4b8439b3d3eabc6b62de978ba27434bc01f45d1e0716ad110697da - URLScan ยท 2026-09-17: https://screenshots.phishdestroy.io/us/01a0af8e-8fe3-722b-b462-7c48b30648ee.png Captured: 2026-09-17 13:29:18 UTC Source report: https://urlscan.io/result/01a0af8e-8fe3-722b-b462-7c48b30648ee/ SHA-256: fce3922afe3d87c338752a1c6d0cabaeb4bf4566eeecaf54b42b8f26f57b113b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T21:08:05Z", "uuid": "585876de-3a78-40c1-a4cf-76ebed064bb7", "scanned_at": "2026-09-25T05:02:39Z", "final_url": "https://myatomicwallet.readme.io/inactive", "status": 401, "redirected": "same-domain", "history": [ { "url": "https://myatomicwallet.readme.io/", "status": 302 }, { "url": "https://myatomicwallet.readme.io/inactive", "status": 401 } ], "dom_hash": "98320ca057e84299166cc9c91b98206dd50ca6f5f7a2a1b2d2100fe21149f845", "doc_hash": "40df1a0285aa4d836ce8dc1ecf519178f0be9196c8d96a2705de2e0fc4c803e0", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "cdn.readme.io", "type": "CNAME", "value": "ssl.readmessl.com" }, { "name": "cdn.readme.io", "type": "CNAME", "value": "ssl.readmessl.com" }, { "name": "myatomicwallet.readme.io", "type": "CNAME", "value": "cname.readmessl.com" }, { "name": "myatomicwallet.readme.io", "type": "CNAME", "value": "cname.readmessl.com" } ], "dnssec_valid": false, "ip": "104.16.241.118", "whois": { "registrar": "1API GmbH", "created": "2011-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "expires": "2027-05-17T10:06:31Z", "nameservers": [ "uma.ns.cloudflare.com", "jeremy.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T21:36:05Z", "analysis_at": "2026-10-21T11:30:12Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 3, "suspicious": 0, "undetected": 37 }, "detections": { "CRDF": "malicious", "VIPRE": "malware", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "1API GmbH", "created": "2011-05-17T10:06:31Z", "expires": "2027-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "first_seen": "2026-09-12T10:25:54Z", "dns": [ { "ttl": 98, "type": "CAA", "value": "pki.goog;" }, { "ttl": 120, "type": "CNAME", "value": "cname.readmessl.com" }, { "ttl": 98, "type": "CAA", "value": "comodoca.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6810:f176" }, { "ttl": 98, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 98, "type": "CAA", "value": "ssl.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6810:f276" }, { "ttl": 98, "type": "CAA", "value": "pki.goog;" }, { "ttl": 98, "type": "CAA", "value": "digicert.com" }, { "ttl": 300, "type": "A", "value": "104.16.241.118" }, { "ttl": 98, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 300, "type": "A", "value": "104.16.242.118" }, { "ttl": 98, "type": "CAA", "value": "digicert.com" }, { "ttl": 98, "type": "CAA", "value": "comodoca.com" }, { "ttl": 98, "type": "CAA", "value": "ssl.com" } ], "dns_at": "2026-10-21T11:30:27Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "readme.io", "*.readme.io" ], "issuer": "Google Trust Services / WE1", "serial": "3b6df4b000c463020e342c94488fa3a1", "sha256": "52054a9ca28442ddb0ee75f981b79aebecbf2e9ee1749e6243e6439680556ef5", "subject": "readme.io", "valid_to": "2026-12-07T17:48:12Z", "valid_from": "2026-09-08T16:48:24Z" }, "whois": { "registrar": "1API GmbH", "registrar_iana_id": "1387", "registrar_url": "http://www.1api.net", "created": "2011-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "expires": "2027-05-17T10:06:31Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "jeremy.ns.cloudflare.com", "uma.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```