maxwin138ace[.]firebaseapp[.]com

Analysis of maxwin138ace.firebaseapp.com, reported on July 24, 2026, indicates that the domain is currently offline but exhibits several indicators of malicious activity consistent with a crypto‑related phishing campaign. DNS resolution points to the IP address 199.36.158.100, which is assigned to Fastly, Inc. (AS54113) in the United States. The domain is hosted on Google’s Firebase platform, as reflected by the presence of Firebase, HSTS, and HTTP/3 in the technology fingerprint, and it uses Google‑provided nameservers (ns-cloud.googledomains.com). The SSL certificate is issued by Google Trust Services under the WR4 identifier, confirming a valid TLS chain but offering no assurance of legitimacy.

An HTTP request returns a 404 status, suggesting that the original malicious page is no longer reachable, yet the page title that was captured—"MAXWIN138 | Login Situs Toto 4d Resmi Gacor Slot Hari Ini"—implies a credential‑harvesting front‑end targeting users of a gambling service. VirusTotal analysis recorded a single positive detection out of ninety‑five scanners, and the domain appears on one external blocklist. PhishDestroy has also listed the domain as blocked. Registration information shows the domain was created through Google LLC, providing no direct attribution to the operators.

The combination of a Fastly edge IP, Firebase hosting, a valid Google certificate, and a targeted page title aligns with typical infrastructure used for short‑lived phishing sites. Uncertainty remains regarding the current activity level, as the site returns 404 and is marked offline; however, the historical evidence suggests that the domain was employed to lure victims into submitting login credentials, potentially for subsequent crypto‑drain attacks. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any resurgence of the host or related subdomains.