atomicwllet[.]webflow[.]io

This domain, atomicwllet.webflow.io, is flagged as an active fake exchange scam targeting cryptocurrency users. Infrastructure analysis reveals the domain was registered on March 29, 2026, through Webflow and is currently resolving to 104.18.36.248, a Cloudflare IP located in Canada. The site uses Webflow hosting and Cloudflare CDN, with HTTP/3 enabled, which is consistent with modern phishing infrastructure designed to evade detection and improve performance. The page title explicitly references 'Atomic Wallet - Exchange in One Crypto Wallet,' indicating an attempt to impersonate the legitimate Atomic Wallet service. Security vendors have detected malicious activity, with 19 of 94 flagging the domain as malicious. The domain has no valid nameservers (NS_NOT_FOUND), a technical anomaly that may indicate rapid deployment or poor operational security. The SSL certificate is issued by Google Trust Services (WE1), which provides encryption but does not validate the site's legitimacy. The domain is currently active, returning an HTTP 200 status, and has been blocked by at least one security blocklist. Defenders should treat this domain as high-risk due to its confirmed scam classification, lack of legitimate nameserver configuration, and detection by multiple security vendors. While the exact content of the site has not been analysed, the combination of infrastructure red flags, registration details, and vendor detections strongly supports its classification as a fake exchange. Immediate blocking at the DNS or network level is recommended, along with monitoring for related domains using similar naming conventions or infrastructure patterns. Further investigation into associated IPs, certificates, and registration details may uncover additional linked threats.