# PhishDestroy domain threat record: suitapps.readme.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/suitapps.readme.io/ Machine-readable companion: https://phishdestroy.io/domain/suitapps.readme.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-17 10:14:59 UTC - Last availability or vendor check: 2026-10-22 10:16:39 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 3/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trezor ## Stored infrastructure - Observed IP address: 104.16.241.118 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 302 - Registration date (registry RDAP, readme.io): 2011-05-17 10:06:31 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/suitapps.readme.io - Certificate Transparency search: https://crt.sh/?q=%25.suitapps.readme.io - Web Archive lookup: https://web.archive.org/web/*/https://suitapps.readme.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview suitapps.readme.io is an impersonation phishing page posing as Trezor Suite, the official companion software for Trezor hardware wallets. Its title, "Official Trezor™ Suite App®® — Desktop & Web App", is built to catch people searching for a Trezor download or setup page. The doubled trademark symbols are a typical sign of a fake. PhishDestroy first flagged the page on 2026-09-17, and on 2026-10-19 the site was still alive and serving a redirect. How the scam works The page lives on a subdomain of readme.io, a documentation-hosting service, so it carries a familiar-looking address while having no connection to Trezor. Fake Trezor Suite pages usually work in one of two ways. Some send visitors to a form that asks for the wallet's recovery seed phrase, framed as a restore or verification step. Others push a counterfeit Suite download built to harvest that same information. Anyone who hands over the seed loses control of every asset the hardware wallet protects, because whoever holds the phrase can rebuild the wallet on another device and empty it. Evidence When checked on 2026-10-01, three of 91 VirusTotal engines flagged the page: CRDF, Forcepoint ThreatSeeker and VIPRE. That is low coverage, which means most browser and antivirus protections will not warn a visitor. PhishDestroy is currently the only blocklist listing the domain. The brand claim in the title and the unofficial hosting location support the impersonation classification. Infrastructure The site resolves to Cloudflare, Inc. address space geolocated to Canada, and Cloudflare sits in front of the real origin. Because the page is a subdomain on a shared documentation platform, the domain itself was not newly registered. Effective takedown therefore depends on the platform removing the project, not on a registrar. What to do Trezor never asks you to type your recovery seed into a website or a form inside an app. If you entered your seed on this page or in software downloaded from it, treat the wallet as compromised. Move funds right away to a new wallet set up with a fresh seed on a genuine device. If you installed anything from this page, uninstall it and scan the computer before using it for crypto again. Only get Trezor Suite from Trezor's own site. Defenders should block the subdomain, report it to readme.io and Cloudflare for removal, and watch for other readme.io projects using Trezor branding. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/suitapps.readme.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=suitapps.readme.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:40:57 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/139256c8-711d-40b3-814b-f68284d8beb0.png Captured: 2026-09-25 04:18:29 UTC Source report: https://radar.cloudflare.com/scan/139256c8-711d-40b3-814b-f68284d8beb0 SHA-256: de1287521a4b8439b3d3eabc6b62de978ba27434bc01f45d1e0716ad110697da - URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0aede-be35-7149-bc77-9b619dfc5fca.png Captured: 2026-09-17 10:17:14 UTC Source report: https://urlscan.io/result/01a0aede-be35-7149-bc77-9b619dfc5fca/ SHA-256: b64c4d89d4d8a905d11b8fc405bfe66bb5d5f19a2a5594b7fa3d230ccafd1abd - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151c5-5224-737e-a839-931d28c7d072.png Captured: 2026-10-19 01:27:34 UTC Source report: https://urlscan.io/result/01a151c5-5224-737e-a839-931d28c7d072/ SHA-256: fce3922afe3d87c338752a1c6d0cabaeb4bf4566eeecaf54b42b8f26f57b113b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T21:08:06Z", "uuid": "139256c8-711d-40b3-814b-f68284d8beb0", "scanned_at": "2026-09-25T04:18:29Z", "final_url": "https://suitapps.readme.io/inactive", "status": 401, "redirected": "same-domain", "history": [ { "url": "https://suitapps.readme.io/", "status": 302 }, { "url": "https://suitapps.readme.io/inactive", "status": 401 } ], "dom_hash": "98320ca057e84299166cc9c91b98206dd50ca6f5f7a2a1b2d2100fe21149f845", "doc_hash": "dd440f122727236d3fc4e19434aefca18fc611ddc5315838854c0fde0ebabe27", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "cdn.readme.io", "type": "CNAME", "value": "ssl.readmessl.com" }, { "name": "cdn.readme.io", "type": "CNAME", "value": "ssl.readmessl.com" }, { "name": "suitapps.readme.io", "type": "CNAME", "value": "cname.readmessl.com" }, { "name": "suitapps.readme.io", "type": "CNAME", "value": "cname.readmessl.com" } ], "dnssec_valid": false, "ip": "104.16.242.118", "whois": { "registrar": "1API GmbH", "created": "2011-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "expires": "2027-05-17T10:06:31Z", "nameservers": [ "uma.ns.cloudflare.com", "jeremy.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T21:36:15Z", "analysis_at": "2026-10-21T13:04:15Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 3, "suspicious": 0, "undetected": 36 }, "detections": { "CRDF": "malicious", "VIPRE": "malware", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "1API GmbH", "created": "2011-05-17T10:06:31Z", "expires": "2027-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "first_seen": "2026-09-17T10:14:42Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.16.242.118" }, { "ttl": 300, "type": "CAA", "value": "digicert.com" }, { "ttl": 300, "type": "A", "value": "104.16.241.118" }, { "ttl": 300, "type": "CAA", "value": "digicert.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6810:f176" }, { "ttl": 300, "type": "CAA", "value": "comodoca.com" }, { "ttl": 300, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 120, "type": "CNAME", "value": "cname.readmessl.com" }, { "ttl": 300, "type": "CAA", "value": "comodoca.com" }, { "ttl": 300, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 300, "type": "CAA", "value": "pki.goog;" }, { "ttl": 300, "type": "CAA", "value": "ssl.com" }, { "ttl": 300, "type": "CAA", "value": "ssl.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6810:f276" }, { "ttl": 300, "type": "CAA", "value": "pki.goog;" } ], "dns_at": "2026-10-21T13:04:36Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "readme.io", "*.readme.io" ], "issuer": "Google Trust Services / WE1", "serial": "3b6df4b000c463020e342c94488fa3a1", "sha256": "52054a9ca28442ddb0ee75f981b79aebecbf2e9ee1749e6243e6439680556ef5", "subject": "readme.io", "valid_to": "2026-12-07T17:48:12Z", "valid_from": "2026-09-08T16:48:24Z" }, "whois": { "registrar": "1API GmbH", "registrar_iana_id": "1387", "registrar_url": "http://www.1api.net", "created": "2011-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "expires": "2027-05-17T10:06:31Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "jeremy.ns.cloudflare.com", "uma.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```