# PhishDestroy domain threat record: new-startsio.readme.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/new-startsio.readme.io/ Machine-readable companion: https://phishdestroy.io/domain/new-startsio.readme.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-17 10:15:36 UTC - Last availability or vendor check: 2026-10-22 10:06:10 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 6/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 104.16.242.118 - Registrar in stored WHOIS data: 1API GmbH - Registrar country in stored WHOIS data: DE - Last stored HTTP status: 301 - Registration date (registry RDAP, readme.io): 2011-05-17 10:06:31 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/new-startsio.readme.io - Certificate Transparency search: https://crt.sh/?q=%25.new-startsio.readme.io - Web Archive lookup: https://web.archive.org/web/*/https://new-startsio.readme.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview new-startsio.readme.io is an impersonation phishing page. It sits on a subdomain of a developer documentation hosting platform, not on a domain the scammers registered themselves. It borrows another project's identity to win the trust of crypto users. PhishDestroy first flagged it on 2026-09-17, and on 2026-10-19 the address was still alive and redirecting visitors elsewhere. How the scam works Impersonation pages copy the look, name and wording of a real project so visitors believe they are on an official resource. A documentation-style subdomain adds credibility because many legitimate crypto projects host their guides on such platforms. From there the visitor is steered toward a login, "wallet sync" or support flow, or is redirected onward, as this address currently does. Victims typically lose account credentials, recovery phrases or funds sent to addresses the operators control. Evidence Six of 91 VirusTotal engines classified the page as malicious in a check on 2026-09-25: alphaMountain.ai, CRDF, Emsisoft, Fortinet, Netcraft and Webroot. That is a modest count. Still, Netcraft and Fortinet both track phishing infrastructure closely, so their agreement with our verdict carries weight. Among blocklists, it currently appears on PhishDestroy's list. Infrastructure The 2011-05-17 registration date and the registrar 1API GmbH belong to the parent platform domain. Its age therefore says nothing about how long this operation has existed. Abusing a free subdomain on an established service lets scammers skip domain registration entirely and inherit that service's reputation. Traffic resolves through Cloudflare, Inc. on an address geolocated to Canada, which reflects the platform's delivery network rather than the operators' location. What to do If you entered a password or email on this page, change that password everywhere you reused it and turn on app-based two-factor authentication. Then review recent account activity for logins you do not recognize. If you typed a seed phrase or private key, treat that wallet as compromised and move any remaining funds to a newly created wallet immediately. Do not reply to "support" contacts that reached you through this page. Defenders should block the subdomain specifically, without blocking the parent platform, and report it to the hosting platform's abuse team and to Cloudflare so the redirect can be removed. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/new-startsio.readme.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=new-startsio.readme.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:40:56 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cb6ae783-0739-4f44-93fc-5bdb60d41058.png Captured: 2026-09-25 04:18:29 UTC Source report: https://radar.cloudflare.com/scan/cb6ae783-0739-4f44-93fc-5bdb60d41058 SHA-256: f9916b8cb83dfa9221663a9c4b251ca348308659b8f01eb3ad04ecc654f00fee - URLScan ยท 2026-09-17: https://screenshots.phishdestroy.io/us/01a0aedf-e6a5-707a-909f-29391fff74cf.png Captured: 2026-09-17 10:18:31 UTC Source report: https://urlscan.io/result/01a0aedf-e6a5-707a-909f-29391fff74cf/ SHA-256: 87585dbb14c01e59423ec2443b3cf0c0e55297ee5ca4d26e744ae95ae19a2646 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T21:08:06Z", "uuid": "cb6ae783-0739-4f44-93fc-5bdb60d41058", "scanned_at": "2026-09-25T04:18:29Z", "final_url": "https://new-startsio.readme.io/", "status": 404, "history": [ { "url": "https://new-startsio.readme.io/", "status": 404 } ], "dom_hash": "7fc99aa2d89e0695afe980fa5a4f6850d050e60e0805209b2ab086fa92f20e16", "doc_hash": "0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5", "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "new-startsio.readme.io", "type": "CNAME", "value": "cname.readmessl.com" }, { "name": "new-startsio.readme.io", "type": "CNAME", "value": "cname.readmessl.com" } ], "dnssec_valid": false, "ip": "104.16.241.118", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "1API GmbH", "created": "2011-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "expires": "2027-05-17T10:06:31Z", "nameservers": [ "uma.ns.cloudflare.com", "jeremy.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T21:36:13Z", "analysis_at": "2026-10-18T21:50:27Z", "stats": { "timeout": 0, "harmless": 48, "malicious": 9, "suspicious": 0, "undetected": 35 }, "detections": { "CRDF": "malicious", "ESET": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Information Technology, Phishing (alphaMountain.ai)" }, "registrar": "1API GmbH", "created": "2011-05-17T10:06:31Z", "expires": "2027-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "first_seen": "2026-09-17T10:15:28Z", "dns": [ { "ttl": 300, "type": "CAA", "value": "digicert.com" }, { "ttl": 300, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 300, "type": "CAA", "value": "pki.goog;" }, { "ttl": 300, "type": "A", "value": "104.16.241.118" }, { "ttl": 300, "type": "CAA", "value": "digicert.com" }, { "ttl": 300, "type": "CAA", "value": "ssl.com" }, { "ttl": 300, "type": "CAA", "value": "comodoca.com" }, { "ttl": 300, "type": "CAA", "value": "pki.goog;" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6810:f176" }, { "ttl": 300, "type": "CAA", "value": "ssl.com" }, { "ttl": 300, "type": "CAA", "value": "comodoca.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6810:f276" }, { "ttl": 300, "type": "A", "value": "104.16.242.118" }, { "ttl": 300, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 120, "type": "CNAME", "value": "cname.readmessl.com" } ], "dns_at": "2026-10-18T21:50:41Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "readme.io", "*.readme.io" ], "issuer": "Google Trust Services / WE1", "serial": "3b6df4b000c463020e342c94488fa3a1", "sha256": "52054a9ca28442ddb0ee75f981b79aebecbf2e9ee1749e6243e6439680556ef5", "subject": "readme.io", "valid_to": "2026-12-07T17:48:12Z", "valid_from": "2026-09-08T16:48:24Z" }, "whois": { "registrar": "1API GmbH", "registrar_iana_id": "1387", "registrar_url": "http://www.1api.net", "created": "2011-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "expires": "2027-05-17T10:06:31Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "jeremy.ns.cloudflare.com", "uma.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```