support-atomicwallet-o[.]pages[.]dev

This domain, support-atomicwallet-o.pages.dev, is identified as an active phishing infrastructure specifically designed for brand impersonation targeting Atomic Wallet. The site presents itself as a legitimate Web3 onboarding portal, using the page title 'Getting Started To Web3 With Atomic Wallet Extension' to deceive users into disclosing sensitive wallet credentials or installing malicious extensions. Analysis confirms this domain is currently operational and poses a high-risk threat to cryptocurrency users. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 28, 2026, and resolves to the IP address 172.66.44.59, located in Canada under Cloudflare’s network. The domain appears on one security blocklist and has been flagged by 4 of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to mimic legitimacy. The use of Cloudflare’s hosting and CDN services further complicates takedown efforts and attribution. Current evidence confirms the domain remains active, with no signs of remediation or suspension. Users and organizations are advised to immediately block access to this domain at the network level and update endpoint protection rules to prevent interaction. Cryptocurrency wallet providers should issue alerts to users warning against entering recovery phrases or private keys on any site claiming to be associated with Atomic Wallet. Security teams are encouraged to monitor for additional domains using similar naming conventions (e.g., atomicwallet-support, wallet-atomic-extension) and report them to relevant hosting providers for takedown.