faqs-eng-balncer-fiance[.]pages[.]dev

Analysis shows that the domain faqs-eng-balncer-fiance.pages.dev was registered on 2026-04-09 and is hosted on Cloudflare Pages, resolving to IP 172.66.47.9 which belongs to Cloudflare, Inc. The site serves HTTP 200 responses and presents a TLS certificate issued by Google Trust Services (WE1), indicating a valid HTTPS connection. The page title reads "Balancer Finance – The Ultimate Tool for Portfolio Automation in DeFi," directly referencing the Balancer brand, and the intelligence labels the activity as a brand-impersonation campaign. The domain has been listed on a security blocklist and is already blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. No malware detections have been reported by the 94 VirusTotal scanners, but the absence of detections does not confirm safety. The exact content of the site beyond the title has not been examined, leaving uncertainty about whether credential-stealing forms or malicious redirects are present. Defenders should treat the domain as hostile: add the host to network-level deny lists, enforce URL filtering, and monitor DNS queries for the domain. Further investigation, including a manual content review and correlation with any reported Balancer credential-theft incidents, is recommended to confirm the payload and to inform brand-owner response actions.