sso--atomic-wallet--cdn--auth[.]webflow[.]io

The domain sso--atomic-wallet--cdn--auth.webflow.io was created on March 24, 2026 and is hosted on Cloudflare infrastructure, resolving to IP address 172.64.151.8, which is registered to Cloudflare, Inc. in Canada. The site presented a valid SSL certificate issued by Google Trust Services under the WE1 authority, indicating the use of standard HTTPS encryption. Technical fingerprinting identified the Webflow platform, Cloudflare services, and HTTP/3 support, consistent with the registrar information that the domain was registered through Webflow. The page title returned by the server was "Atomic Wallet | Atomic Wallet™ Knowledge Base," suggesting an attempt to masquerade as the official knowledge base of the cryptocurrency wallet service Atomic Wallet.

HTTP probing returned a 404 status, and the domain is currently marked as offline. Reputation data shows a Gridinsoft trust score of 0 out of 100, reflecting a highly suspicious profile. VirusTotal analysis recorded 16 detections out of 94 security vendors, and the domain appears on a single blocklist, specifically PhishDestroy, which has already taken action to block it. The classification of the campaign is a crypto‑related scam that impersonates Atomic Wallet.

While the available evidence confirms the use of legitimate SSL and reputable hosting, the combination of low trust scoring, multiple vendor detections, and blocklist inclusion indicates a high likelihood of malicious intent. Defenders should continue to block the domain at perimeter defenses, monitor for any resurrection attempts, and update detection signatures to include the observed SSL fingerprint and IP address. Continuous observation of related Webflow‑hosted subdomains is recommended, as the attacker may leverage the same registration pathway for future impersonation attempts.