ace-coins-bse-xtension-web[.]pages[.]dev

Analysis indicates that the domain ace-coins-bse-xtension-web.pages.dev is a confirmed credential phishing site, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through Cloudflare, Inc., and uses Cloudflare nameservers (karina.ns.cloudflare.com, gabe.ns.cloudflare.com). It resolves to the IP address 172.66.47.135, hosted on Cloudflare's network (AS13335) in the US. The SSL certificate is issued by Google Trust Services (WE1), and the domain employs HSTS and HTTP/3 technologies.

Security vendor detections include 14 flags on VirusTotal out of 93 vendors, and Google Safe Browsing classifies the domain as engaging in social engineering. Scamadviser and Gridinsoft both assign trust scores of 1/100 and 0/100, respectively, while PhishDestroy has blocked the domain. The domain appears on one security blocklist. The HTTP status is 403, and the page title displayed by Cloudflare is 'Suspected phishing site | Cloudflare,' which aligns with its current offline status.

Defenders should treat this domain as high-risk infrastructure. Although the site is offline, its historical use for credential phishing warrants monitoring for reactivation or migration to new domains. The Cloudflare Pages hosting and lack of explicit brand targeting in available data suggest a generic phishing operation, but the exact target (e.g., financial, cryptocurrency, or corporate credentials) remains unconfirmed. Blocking the domain at the DNS or proxy level is recommended for organizations, and security teams should review logs for prior connections to 172.66.47.135 or associated subdomains.