# PhishDestroy domain threat record: webiostart.readme.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/webiostart.readme.io/ Machine-readable companion: https://phishdestroy.io/domain/webiostart.readme.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-17 10:15:59 UTC - Last availability or vendor check: 2026-10-22 10:30:01 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 5/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 104.16.241.118 - Registrar in stored WHOIS data: 1API GmbH - Registrar country in stored WHOIS data: DE - Last stored HTTP status: 302 - Registration date (registry RDAP, readme.io): 2011-05-17 10:06:31 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/webiostart.readme.io - Certificate Transparency search: https://crt.sh/?q=%25.webiostart.readme.io - Web Archive lookup: https://web.archive.org/web/*/https://webiostart.readme.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview webiostart.readme.io is an impersonation phishing page built on a subdomain of readme.io, a documentation hosting platform. Its page title is simply "webiostart", which presents it as an official setup or getting-started guide. PhishDestroy first detected it on 2026-09-17. On 2026-10-19 the site was still alive and redirecting visitors onward. How the scam works Impersonation pages like this borrow the look and tone of a legitimate onboarding or support guide so the visitor trusts the instructions. The "webiostart" title frames the page as a first step, and the redirect then moves the visitor to wherever the operator collects input. In schemes of this kind, that input is usually account credentials, one-time codes, or a wallet recovery phrase, and anyone who supplies it loses control of the account or funds behind it. The page title does not name a specific brand, but we classify the page as impersonation phishing. Evidence On 2026-10-01, 5 of 91 VirusTotal engines flagged the address: alphaMountain.ai, Emsisoft, Forcepoint ThreatSeeker, Fortinet and Netcraft. That count is low, so most browsers and filters will not warn users. The five flags come from separate vendors, though, and they match PhishDestroy's own listing. Infrastructure The 2011-05-17 registration date through 1API GmbH belongs to the shared readme.io parent domain. It says nothing about when this page was created. Because the page sits on a trusted documentation platform, it inherits that platform's reputation, and domain-age checks will not catch it. Traffic is served through Cloudflare, Inc. from an address located in Canada, behind a standard Google Trust Services certificate. What to do If you followed this page and typed a password, change it right away on the real service and on any other account that uses the same one. Then turn on app-based two-factor authentication. If you entered a recovery phrase or private key, treat that wallet as compromised and move any remaining funds to a newly created wallet. Defenders should block the full subdomain rather than readme.io as a whole and report the page to the platform's abuse team. They should also check proxy logs for users who reached it after 2026-09-17. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/webiostart.readme.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=webiostart.readme.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:40:57 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5de43bf5-29ac-4384-8999-b8756dfaa2d8.png Captured: 2026-09-25 04:47:49 UTC Source report: https://radar.cloudflare.com/scan/5de43bf5-29ac-4384-8999-b8756dfaa2d8 SHA-256: de1287521a4b8439b3d3eabc6b62de978ba27434bc01f45d1e0716ad110697da - URLScan ยท 2026-09-17: https://screenshots.phishdestroy.io/us/01a0aee2-3250-7382-b3aa-7d3c1c4d4f31.png Captured: 2026-09-17 10:21:06 UTC Source report: https://urlscan.io/result/01a0aee2-3250-7382-b3aa-7d3c1c4d4f31/ SHA-256: 06cb81f6401c88bceb8445c9edd621dac8324317227eadddbaf4676dc391cae2 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T21:08:06Z", "uuid": "5de43bf5-29ac-4384-8999-b8756dfaa2d8", "scanned_at": "2026-09-25T04:47:49Z", "final_url": "https://webiostart.readme.io/inactive", "status": 401, "redirected": "same-domain", "history": [ { "url": "https://webiostart.readme.io/", "status": 302 }, { "url": "https://webiostart.readme.io/inactive", "status": 401 } ], "dom_hash": "98320ca057e84299166cc9c91b98206dd50ca6f5f7a2a1b2d2100fe21149f845", "doc_hash": "86a2689195f9fd6f6afa89483e3880f71916db2b8dc80cd3ed08dc0053c3d8fd", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "cdn.readme.io", "type": "CNAME", "value": "ssl.readmessl.com" }, { "name": "cdn.readme.io", "type": "CNAME", "value": "ssl.readmessl.com" }, { "name": "webiostart.readme.io", "type": "CNAME", "value": "cname.readmessl.com" }, { "name": "webiostart.readme.io", "type": "CNAME", "value": "cname.readmessl.com" } ], "dnssec_valid": false, "ip": "104.16.241.118", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "1API GmbH", "created": "2011-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "expires": "2027-05-17T10:06:31Z", "nameservers": [ "uma.ns.cloudflare.com", "jeremy.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T21:36:11Z", "analysis_at": "2026-10-21T11:08:39Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 5, "suspicious": 0, "undetected": 35 }, "detections": { "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "alphaMountain.ai": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "1API GmbH", "created": "2011-05-17T10:06:31Z", "expires": "2027-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "first_seen": "2026-09-17T10:15:47Z", "dns": [ { "ttl": 300, "type": "CAA", "value": "ssl.com" }, { "ttl": 300, "type": "CAA", "value": "pki.goog;" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6810:f276" }, { "ttl": 300, "type": "CAA", "value": "comodoca.com" }, { "ttl": 300, "type": "CAA", "value": "ssl.com" }, { "ttl": 300, "type": "CAA", "value": "pki.goog;" }, { "ttl": 300, "type": "CAA", "value": "comodoca.com" }, { "ttl": 120, "type": "CNAME", "value": "cname.readmessl.com" }, { "ttl": 300, "type": "A", "value": "104.16.241.118" }, { "ttl": 300, "type": "A", "value": "104.16.242.118" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6810:f176" }, { "ttl": 300, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 300, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 300, "type": "CAA", "value": "digicert.com" }, { "ttl": 300, "type": "CAA", "value": "digicert.com" } ], "dns_at": "2026-10-21T11:08:54Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "readme.io", "*.readme.io" ], "issuer": "Google Trust Services / WE1", "serial": "3b6df4b000c463020e342c94488fa3a1", "sha256": "52054a9ca28442ddb0ee75f981b79aebecbf2e9ee1749e6243e6439680556ef5", "subject": "readme.io", "valid_to": "2026-12-07T17:48:12Z", "valid_from": "2026-09-08T16:48:24Z" }, "whois": { "registrar": "1API GmbH", "registrar_iana_id": "1387", "registrar_url": "http://www.1api.net", "created": "2011-05-17T10:06:31Z", "updated": "2026-08-12T10:17:07Z", "expires": "2027-05-17T10:06:31Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "jeremy.ns.cloudflare.com", "uma.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```