acedeckpro[.]top

On July 25, 2026 analysts observed that the domain acedeckpro.top is being used for a brand‑impersonation campaign targeting the scroll brand. The site’s page title, "AceDeck – Willkommen bei AceDeck – deinem ultimativen Begleiter in der Welt der Poker‑Sets, Homegames und Kartenspiele!", was captured during a brief crawl and indicates a German‑language landing page that references poker sets rather than the legitimate scroll services, confirming the impersonation intent. The domain was registered on November 04, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and is hosted behind Cloudflare’s network (ASN 13335) with the IP address 104.21.38.194 located in the United States. No SSL certificate was presented, meaning the site operated over plain HTTP, which could facilitate credential harvesting or script injection.

Reputation checks show extremely low trust scores: Scamadviser rated the domain 1 / 100 and Gridinsoft assigned 0 / 100, underscoring its malicious nature. The domain resolves to two Cloudflare nameservers, gracie.ns.cloudflare.com and margo.ns.cloudflare.com, a common pattern for fast‑flux or abuse of CDN services. Threat‑intel aggregation identified the domain in a single AlienVault OTX pulse and on one public security blocklist; PhishDestroy has also listed the domain as blocked. VirusTotal analysis returned detections from seven of ninety‑five scanners, reinforcing the suspicion of malicious activity.

The site is currently offline, but the infrastructure artefacts remain observable. Defenders should continue to monitor the IP address 104.21.38.194 and associated Cloudflare ASN for any re‑use, update firewalls and DNS filtering solutions to block acedeckpro.top, and consider adding the domain and its IP to internal blocklists. Additional investigation is warranted to locate any related domains that share the same registrar or nameserver configuration, as threat actors often deploy multiple aliases under a shared hosting provider.