atomic-wallitextension[.]webflow[.]io

This domain, atomic-wallitextension.webflow.io, poses a specific threat of crypto drainer phishing, targeting users of cryptocurrency wallets. The site impersonates a legitimate Atomic Wallet extension, aiming to trick users into divulging their private keys, which can lead to unauthorized access and potential theft of cryptocurrency assets.

Analysis indicates that atomic-wallitextension.webflow.io is flagged by 19 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion. The domain is registered through Webflow and appears on one known security blocklist. The IP address 172.64.151.8, associated with Cloudflare, Inc. in Canada (CA), is the current resolution point for this domain. Although the domain is currently offline, the risk remains elevated due to its prior malicious activities and the potential for reactivation.

Users who have visited atomic-wallitextension.webflow.io are advised to immediately check their cryptocurrency wallets for any unauthorized transactions. They should also change passwords and enable two-factor authentication (2FA) for their wallet accounts. It is recommended to use official and verified channels for downloading or accessing cryptocurrency wallet extensions to avoid similar phishing attempts.