digital--atomic-wallet--auth[.]webflow[.]io

This domain, digital--atomic-wallet--auth.webflow.io, is identified as a high-risk phishing resource impersonating Atomic Wallet, a cryptocurrency wallet service. The site employs brand impersonation techniques to deceive users into submitting sensitive credentials, likely facilitating unauthorized access to digital assets. No explicit drainer kit signatures were detected in initial analysis, though the infrastructure aligns with credential harvesting campaigns targeting cryptocurrency platforms. Technical indicators confirm the domain's malicious intent. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious. The domain was registered through NameCheap, Inc., and resolves to the IP address 104.18.36.248, hosted on Cloudflare's infrastructure (AS13335). The domain was created on February 21, 2026, though this date may reflect registry manipulation or a placeholder. Google Safe Browsing classifies the domain as phishing, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing sites leveraging legitimate CDN services to evade detection. The domain is currently offline, mitigating immediate user exposure. However, the infrastructure remains a residual risk, as threat actors may reactivate or repurpose the domain. Response actions included takedown coordination with the hosting provider and registrar, though no legal or law enforcement involvement has been confirmed. Users who interacted with the domain should assume credential compromise and initiate account recovery protocols, including password resets and multi-factor authentication enforcement. Monitoring for follow-up phishing attempts via associated email addresses or wallet identifiers is recommended.