en-doc--atomicwallet[.]webflow[.]io

en-doc--atomicwallet.webflow.io has been flagged as an active crypto-draining domain masquerading as Atomic Wallet’s official site. The campaign leverages a convincing fake page hosted on Webflow to trick victims into connecting wallets and authorizing malicious token transfers. With an elevated risk rating, this domain poses an immediate threat to cryptocurrency users who may unwittingly surrender control of their digital assets. PhishDestroy identifies the seed edc160 as the unique campaign marker for this drainer operation. This domain resolves to IP address 104.18.36.248 and is currently detected by 16 out of 95 VirusTotal security vendors. The infrastructure relies on Google Trust Services for SSL encryption, lending a false sense of legitimacy to its phishing pages. Its Webflow hosting platform adds another layer of obfuscation, making it harder for users to instantly recognize the threat. While creation details remain obscured by the platform’s privacy settings, the current blocklist status and high detection rate underscore the severity of the risk it presents to potential victims. To mitigate exposure to this drainer, users should avoid clicking links from unsolicited messages or unfamiliar domains. Always verify URLs against official sources and use hardware wallets or transaction simulation tools before authorizing transfers. Organizations are advised to block both the domain and IP 104.18.36.248 at the network perimeter and update browser-based blocklists. Report any suspicious interactions involving this domain or its seed edc160 for further threat hunting.