atomic-wallet[.]at

Atomic-wallet.at was observed to host a malicious page titled “Atomic Wallet: Befst Crypto Wallet Download”, indicating an attempt to masquerade as the legitimate Atomic Wallet application. The site resolves to the IPv4 address 45.82.82.240, which is assigned to the Russian autonomous system AS9123 operated by JSC TIMEWEB. DNS resolution is provided by the dnspod.com name server cluster (a.dnspod.com, b.dnspod.com, c.dnspod.com). No TLS certificate is presented, meaning the connection is unencrypted and susceptible to interception. Scamadviser assigns a trust score of 46 out of 100, reflecting a low confidence rating for the domain.

The listed scam type is “Wallet/Seed Phishing,” confirming that the infrastructure is intended to harvest cryptocurrency wallet credentials or seed phrases. The domain is flagged by four independent blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and it currently appears on four security blocklists. VirusTotal analysis shows that 14 of 95 scanning engines classify the domain as malicious, providing additional corroboration of its threat nature. The domain is explicitly marked as impersonating the Atomic Wallet brand, confirming a targeted brand‑impersonation campaign.

The site has been taken offline as of the report date, but historical evidence remains relevant for threat intelligence sharing. Uncertainty remains regarding the full extent of victim interaction, such as whether any seed phrases were actually captured before takedown. Defenders should continue to block the domain at network perimeter, update URL filtering policies, and monitor for any related domains that reuse the same name‑server configuration or IP range. Incident response teams should also advise users of Atomic Wallet to verify the authenticity of download sources and to treat any unsolicited requests for seed phrases as malicious.