# PhishDestroy domain threat record: websuite-app.grigora.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/websuite-app.grigora.app/
Machine-readable companion: https://phishdestroy.io/domain/websuite-app.grigora.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 01:29:06 UTC
- Last availability or vendor check: 2026-10-23 10:03:31 UTC
- Stored record updated: 2026-10-23 14:23:11 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Trezor

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Squarespace Domains II LLC
- Last stored HTTP status: 200
- Registration date (registry RDAP, grigora.app): 2022-12-31 08:27:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16667-d483-704c-82f9-8ac9541402e3/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/websuite-app.grigora.app
- Certificate Transparency search: https://crt.sh/?q=%25.websuite-app.grigora.app
- Web Archive lookup: https://web.archive.org/web/*/https://websuite-app.grigora.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added websuite-app.grigora.app to its internal blocklist as a suspicious domain. The page displayed the title "Official Trezor™ Suite®® App — Desktop & Web App". The domain was first seen by PhishDestroy on 2026-10-23 and returned HTTP 200 at that time. A client‑side redirect sent the browser to tholy-art-43e5.maxtwo.workers.dev, a cross‑site destination.

How the scam works
Suspicious domains often impersonate well‑known brands and use redirects to move visitors to unrelated hosts where phishing pages or malware may be served. In this case the site claims to be a Trezor Suite app but no malicious payload was observed on the landing page itself. The presence of malicious detections suggests the domain could be used to harvest credentials or deliver unwanted content, though the exact mechanism was not captured in the scans.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported four detections from 92 engines, including two malicious labels from LevelBlue and PhishFort and two suspicious labels from ESET and alphaMountain.ai. Google Safe Browsing checked on 2026-10-23 and did not flag the domain. urlscan.io captured the page on 2026-10-21, marking the overall verdict as clean but its engine scoring flagged it as malicious with a score of 65. OTX listed zero pulses as of 2026-10-23, and no external blocklists reported the domain at that time.

Infrastructure
The recorded DNS returned Cloudflare‑served IPs such as 188.114.97.1, and the observed TLS certificate was issued to grigora.app and was valid through 2027-01-07.

What to do
Visitors should avoid entering any credentials, downloading files, or granting wallet permissions on this site; if any information was submitted, change the associated passwords and review account activity. Security teams should block the exact hostname websuite-app.grigora.app and monitor for any redirects to tholy-art-43e5.maxtwo.workers.dev in their logs. Continue to watch for updates from PhishDestroy and other threat feeds for any changes in the domain's behavior.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a15fed-995e-751e-8972-3948705415b7/
Cloudflare Radar report: https://radar.cloudflare.com/scan/0993dbef-53b2-4829-b692-2eb9d401e9b2
Stored capture screenshot: https://urlscan.io/screenshots/01a15fed-995e-751e-8972-3948705415b7.png
Cloudflare Radar screenshot (2026-10-23T01:33:37Z): https://screenshots.phishdestroy.io/cf/0993dbef-53b2-4829-b692-2eb9d401e9b2.png
URLScan screenshot (2026-10-21T12:27:43Z): https://screenshots.phishdestroy.io/us/01a15e6e-5fc3-7179-941e-85a126f47847.png
URLScan capture report: https://urlscan.io/result/01a15e6e-5fc3-7179-941e-85a126f47847/
URLScan screenshot (2026-10-23T01:36:17Z): https://screenshots.phishdestroy.io/us/01a16666-b863-753b-892c-bf5a4ecb4de3.png
URLScan capture report: https://urlscan.io/result/01a16666-b863-753b-892c-bf5a4ecb4de3/
URLScan screenshot (2026-10-23T01:37:28Z): https://screenshots.phishdestroy.io/us/01a16667-d483-704c-82f9-8ac9541402e3.png
URLScan capture report: https://urlscan.io/result/01a16667-d483-704c-82f9-8ac9541402e3/
VirusTotal report: https://www.virustotal.com/gui/domain/websuite-app.grigora.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=websuite-app.grigora.app
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 01:38:49 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16667-d483-704c-82f9-8ac9541402e3.png
  Captured: 2026-10-23 01:39:24 UTC
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16667-d483-704c-82f9-8ac9541402e3.png
  Captured: 2026-10-23 01:37:28 UTC
  Source report: https://urlscan.io/result/01a16667-d483-704c-82f9-8ac9541402e3/
  SHA-256: 319d6a3e0c8ee14aac6b9b5db1906fd550c309af6fcd93c8821eccbb1bde8245
- URLScan capture 2: https://urlscan.io/screenshots/01a15fed-995e-751e-8972-3948705415b7.png
  Captured: 2026-10-23 01:29:06 UTC
  Source report: https://urlscan.io/result/01a16667-d483-704c-82f9-8ac9541402e3/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0993dbef-53b2-4829-b692-2eb9d401e9b2.png
  Captured: 2026-10-23 01:33:37 UTC
  Source report: https://radar.cloudflare.com/scan/0993dbef-53b2-4829-b692-2eb9d401e9b2
  SHA-256: 329e169179b792335ee716155fd3ef2dbb2f35db9b3443adcc535587e3467b19
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15e6e-5fc3-7179-941e-85a126f47847.png
  Captured: 2026-10-21 12:27:43 UTC
  Source report: https://urlscan.io/result/01a15e6e-5fc3-7179-941e-85a126f47847/
  SHA-256: ed7cfce3ca2a0f9dc54a7009da4e089b0d54af80063c41d6f3bd451ef2e62506
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16666-b863-753b-892c-bf5a4ecb4de3.png
  Captured: 2026-10-23 01:36:17 UTC
  Source report: https://urlscan.io/result/01a16666-b863-753b-892c-bf5a4ecb4de3/
  SHA-256: 319d6a3e0c8ee14aac6b9b5db1906fd550c309af6fcd93c8821eccbb1bde8245

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T02:00:59Z",
        "uuid": "01a16667-d483-704c-82f9-8ac9541402e3",
        "scanned_at": "2026-10-23T01:37:28Z",
        "final_url": "https://tholy-art-43e5.maxtwo.workers.dev/",
        "status": 200,
        "redirected": "off-domain",
        "redirects": [
            {
                "to": "https://websuite-app.grigora.app/",
                "from": "http://websuite-app.grigora.app/",
                "status": 307
            },
            {
                "to": "https://tholy-art-43e5.maxtwo.workers.dev/",
                "from": "https://websuite-app.grigora.app/"
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.gstatic.com",
            "code.jquery.com",
            "fonts.googleapis.com",
            "ajax.googleapis.com",
            "websuite-app.grigora.app",
            "prod.grigora-cdn.com",
            "client-analytics.grigora.co"
        ],
        "ips": [
            "142.251.13.94",
            "151.101.193.155",
            "142.250.154.95",
            "142.251.14.95",
            "104.17.25.14",
            "104.17.207.5",
            "188.114.97.3"
        ],
        "asns": [
            "15169",
            "54113",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "6017677e8db6b4dcddc9dec94735f9c07b54c0acecd2efae6aade18a034496f6",
        "script_hashes": [
            "18a6c2706055c2618db7ae60101ff28d21a584351a08c32284a37e8389d33c13"
        ],
        "globals": [
            "$",
            "jQuery",
            "uidEvent",
            "bootstrap",
            "updateInputFields",
            "validateInput",
            "handleNextStep",
            "vma_4e6cf3",
            "bip39Words",
            "currentWordCount",
            "detectDevTools",
            "vmG",
            "vmQ_dfa0f8"
        ],
        "tls": {
            "san": [
                "grigora.app",
                "*.grigora.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "grigora.app",
            "protocol": "QUIC",
            "valid_to": "2027-01-07T21:05:06Z",
            "valid_from": "2026-10-09T20:05:09Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 21,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "trezor"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Trezor"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T01:38:07Z",
        "uuid": "0993dbef-53b2-4829-b692-2eb9d401e9b2",
        "scanned_at": "2026-10-23T01:33:37Z",
        "final_url": "https://tholy-art-43e5.maxtwo.workers.dev/",
        "status": 200,
        "history": [
            {
                "url": "https://websuite-app.grigora.app/",
                "status": 200
            },
            {
                "url": "https://tholy-art-43e5.maxtwo.workers.dev/",
                "status": 200
            }
        ],
        "dom_hash": "e4b31dc3d1c7de04818a9b0b985d01473e506eacd7feffa4fa5904399d3f58c6",
        "doc_hash": "6017677e8db6b4dcddc9dec94735f9c07b54c0acecd2efae6aade18a034496f6",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tholy-art-43e5.maxtwo.workers.dev",
                "type": "A",
                "value": "104.21.56.250"
            },
            {
                "name": "tholy-art-43e5.maxtwo.workers.dev",
                "type": "A",
                "value": "172.67.157.60"
            },
            {
                "name": "tholy-art-43e5.maxtwo.workers.dev",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:38fa"
            },
            {
                "name": "tholy-art-43e5.maxtwo.workers.dev",
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:9d3c"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.56.250",
        "whois": {
            "registrar": "CloudFlare, Inc.",
            "created": "2019-02-08T20:36:47Z",
            "updated": "2025-11-16T12:00:30Z",
            "expires": "2027-02-08T20:36:47Z",
            "nameservers": [
                "clyde.ns.cloudflare.com",
                "sofia.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T01:32:46Z",
        "analysis_at": "2026-10-21T22:29:33Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 2,
            "suspicious": 2,
            "undetected": 37
        },
        "detections": {
            "ESET": "suspicious",
            "LevelBlue": "phishing",
            "PhishFort": "phishing",
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Information Technology, Suspicious (alphaMountain.ai)"
        },
        "registrar": "Squarespace Domains II LLC",
        "created": "2022-12-31T08:27:18Z",
        "expires": "2026-12-31T08:27:18Z",
        "updated": "2024-12-01T07:43:25Z",
        "first_seen": "2026-10-21T12:27:16Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.189.179"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:bdb3"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.65.87"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::6815:4157"
            }
        ],
        "dns_at": "2026-10-21T22:34:53Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "grigora.app",
                "*.grigora.app"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "fb9eade8e4e39ae00edf531c73e9f4c5",
            "sha256": "48e27a96796e834b1e1f813bd57c76ea53aec069004264a13ea0fadc03c53212",
            "subject": "grigora.app",
            "valid_to": "2027-01-07T21:05:06Z",
            "valid_from": "2026-10-09T20:05:09Z"
        },
        "whois": {
            "registrar": "Squarespace Domains II LLC",
            "registrar_iana_id": "895",
            "registrar_url": "domains.squarespace.com",
            "created": "2022-12-31T08:27:18Z",
            "updated": "2024-11-26T07:43:25Z",
            "expires": "2026-12-31T08:27:18Z",
            "status": [
                "client",
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "chin.ns.cloudflare.com",
                "malcolm.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T01:38:19Z",
        "caa_records": {
            "domain": "websuite-app.grigora.app"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T01:32:20Z",
            "first": "2026-10-23T01:32:20Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 4757
        },
        "robots_txt": {
            "present": true
        },
        "sitemap": {
            "present": true,
            "url_count": 6
        },
        "social_tags": {
            "ogUrl": "https://websuite-app.grigora.app",
            "title": "Official Trezor™ Suite®® App — Desktop & Web App",
            "ogType": "website",
            "robots": "index,follow",
            "ogTitle": "Official Trezor™ Suite®® App — Desktop & Web App",
            "generator": "Grigora",
            "ogSiteName": "Affectionate Kirch",
            "description": "Discover the Trezor Suite App for managing supported cryptocurrencies, monitoring account balances, reviewing transactions, and connecting your compatible Trezor hardware wallet.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://websuite-app.grigora.app/"
        },
        "trackers": {
            "requests": 16,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "Google APIs",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jQuery",
                    "company": "JS Foundation",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://client-analytics.grigora.co/script.js",
                "https://prod.grigora-cdn.com/projects/4b68b74d-c6d5-4cd1-ba8e-3bb8328929ba/js/ab4fca9b-bead-4148-ab0c-fceda9cfdc5e-1792668210.js"
            ],
            "third_party_scripts": 2
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 17,
                "tls": 15,
                "wait": 160,
                "connect": 34,
                "download": 1
            },
            "response_ms": 227
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 10072,
            "co2_grams": 0.0004,
            "cleaner_than": 72
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.195.226",
                    "host": "clayton.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.235",
                    "host": "katelyn.ns.cloudflare.com"
                }
            ],
            "zone": "grigora.app"
        },
        "location": {
            "ip": "2a06:98c1:3121::9",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Washington",
            "country": "US"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "grigora.app"
        },
        "dns": {
            "A": [
                "188.114.97.9",
                "188.114.96.9"
            ],
            "AAAA": [
                "2a06:98c1:3121::9",
                "2a06:98c1:3120::9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::9",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://websuite-app.grigora.app"
            ]
        },
        "subdomains": {
            "count": 4,
            "subdomains": [
                "builder.grigora.app",
                "cdn.grigora.app",
                "websites-cache.grigora.app",
                "websites.grigora.app"
            ]
        },
        "linked_pages": {
            "external": [
                "https://grigora.co/"
            ],
            "external_count": 1
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```