atomicwallet[.]trade

The domain www.atomicwallet.trade was registered on February 25, 2026 and was observed hosting a page whose title reads “Atomic Wallet : Buy, Stake and Exchange in One Crypto Wallet”. The page title explicitly references the legitimate brand Atomic Wallet, indicating a brand‑impersonation campaign aimed at crypto users. Technical fingerprinting shows the site was served over Nginx with a PHP backend and employed HTTP Strict Transport Security (HSTS), suggesting an attempt to appear legitimate. The TLS certificate was issued by the R3 intermediate authority, a common Let’s Encrypt chain, and the site resolved to the IP address 172.96.187.218, which belongs to AS32475 (Internap Holding LLC) located in the United States.

Two of ninety‑three VirusTotal scanners flagged the domain, and the domain appears on one external security blocklist. The phishing‑defense platform PhishDestroy listed the domain as blocked, and the current operational status is offline, indicating that the site has been taken down or otherwise removed from public access. No further content analysis, such as login form capture or malware payload, is publicly available.

Given the confirmed brand impersonation and the presence of a valid SSL certificate, threat actors likely intended to harvest cryptocurrency credentials or lure victims into fraudulent transactions. Defenders should add www.atomicwallet.trade to URL filtering and DNS blocklists, monitor the hosting IP 172.96.187.218 for related activity, and review any recent authentication attempts against legitimate Atomic Wallet services for signs of credential reuse. Continuous observation of the associated IP range and periodic re‑scanning of the domain are recommended to detect any re‑activation attempts.