aatomnikkwall[.]webflow[.]io

Analysis indicates that the domain aatomnikkwall.webflow.io is a confirmed crypto scam targeting users of Atomic Wallet. The domain was registered on March 24, 2026, through Webflow and is hosted on Cloudflare infrastructure, resolving to the IP address 172.64.151.8, located in Canada. The page title, 'Atomic wallet - us - Atomic,' directly references Atomic Wallet, a cryptocurrency service, aligning with the scam type classified as a crypto scam in available intelligence. The domain currently returns an HTTP 404 status, suggesting it has been taken offline or is no longer actively serving content as of July 23, 2026.

Infrastructure analysis reveals the use of Webflow for hosting and Cloudflare for CDN services, with HTTP/3 detected as the protocol. The domain lacks configured nameservers, which may indicate an attempt to obscure tracking or hinder takedown efforts. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. While the domain appears on one security blocklist and is blocked by PhishDestroy, 18 out of 94 security vendors on VirusTotal flagged it as malicious, reinforcing its classification as a threat.

Gridinsoft assigns a trust score of 0/100, further corroborating the domain's malicious nature. Defenders should treat this domain as part of a crypto-focused phishing campaign and prioritize blocking or monitoring related infrastructure. Given its current offline status, the domain may resurface under a different name or infrastructure, necessitating continued vigilance. The exact content of the phishing page is not yet analyzed, but the available evidence—including the page title, scam classification, and detection by multiple security vendors—supports its identification as a crypto scam targeting Atomic Wallet users.