attoimcewallti[.]webflow[.]io

This domain, attoimcewallti.webflow.io, is identified as a phishing site specifically targeting users of Atomic Wallet, a cryptocurrency wallet service. The site impersonates the legitimate Atomic Wallet interface to deceive victims into submitting sensitive credentials, including private keys or recovery phrases, which could lead to unauthorized access and theft of digital assets. Analysis indicates the page title explicitly mimics the legitimate service, displaying 'Atomic W𝗮llet - Exchange in One Crypto Wallet,' a clear attempt to mislead users into believing the site is authentic. The domain is currently offline, though prior activity suggests it was actively used in credential harvesting operations. Infrastructure analysis reveals the domain was registered on March 07, 2026, through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. The site resolves to the IP address 104.18.36.248, which is part of AS13335, operated by Cloudflare, Inc., a provider frequently utilized to obfuscate the true origin of malicious infrastructure. Detection metrics indicate the domain was flagged by 17 of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate, issued by Google Trust Services under the identifier WE1, further corroborates the use of widely trusted but easily obtainable encryption standards to lend an air of legitimacy to the phishing operation. As of the latest assessment, attoimcewallti.webflow.io has been taken offline, though the infrastructure remains a potential vector for future malicious activity. Users who may have interacted with this domain are advised to immediately revoke any credentials or recovery phrases entered on the site and monitor associated cryptocurrency wallets for unauthorized transactions. Organizations and individuals should update security blocklists to include this domain and its associated IP address, 104.18.36.248, to prevent future access. Continuous monitoring of newly registered domains impersonating cryptocurrency services is recommended, particularly those leveraging Cloudflare-hosted infrastructure and registered through high-volume registrars.