# PhishDestroy domain threat record: www-balancer.fi Content language: English Canonical HTML report: https://phishdestroy.io/domain/www-balancer.fi/ Machine-readable companion: https://phishdestroy.io/domain/www-balancer.fi/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-02 02:00:08 UTC - Last availability or vendor check: 2026-10-23 10:48:07 UTC - Stored record updated: 2026-10-23 18:23:11 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Balancer ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Xonet Oy - Last stored HTTP status: 200 - Registration date (registry RDAP, www-balancer.fi): 2026-09-01 19:40:52 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a05fd6-8f42-7308-9635-d7d347fdc433/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/www-balancer.fi - Certificate Transparency search: https://crt.sh/?q=%25.www-balancer.fi - Web Archive lookup: https://web.archive.org/web/*/https://www-balancer.fi/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview www-balancer.fi is an impersonation phishing domain built around the Balancer name and aimed at people who trade, swap or provide liquidity on the Balancer DeFi protocol. The hyphenated "www-" prefix is meant to look like an ordinary web address for the real project at a glance. PhishDestroy first flagged it on 2026-09-02, and the site was still online and serving content when last checked on 2026-10-19. How the scam works Lookalike DeFi domains like this rely on users arriving from search results, social media replies or direct messages and believing they are on the genuine Balancer interface. The usual goal is to get the visitor to connect a wallet and sign a transaction or token approval, which lets the operator move the victim's tokens or LP positions without further consent. The page currently carries the title "NorthPeak Marketing | New York Growth Agency", which does not match the Balancer branding of the domain, while our classification is Balancer impersonation phishing. Evidence Wallet-security ecosystems have independently listed the domain: it appears on the MetaMask and SEAL blocklists alongside PhishDestroy, and Spamhaus lists it in its domain blocklist under the phishing category. On VirusTotal, 5 of 92 engines flagged it as of 2026-10-16: alphaMountain.ai, CRDF, Fortinet, Gridinsoft and SOCRadar. That count is low, so many browsers and security products will not warn visitors yet. It is also referenced in 4 AlienVault OTX threat pulses. Infrastructure The domain was registered on 2026-09-01 through Finnish registrar Xonet Oy and was detected only a day later. That gap points to a site set up specifically for this campaign rather than an older domain that was later compromised. It sits behind Cloudflare's network, which masks the real origin server, with the edge address geolocated to Canada. What to do Do not connect a wallet or sign anything on www-balancer.fi. If you already connected, use a token-approval checker to revoke any allowances granted while on the site. If you signed a transaction you did not fully understand, move your remaining funds to a fresh wallet. Never type a seed phrase into any site, and if you did, treat that wallet as compromised. Reach Balancer only through bookmarks you saved yourself. Defenders should block the domain at DNS and proxy level and report it to Cloudflare and the registrar so it can be taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05fd6-8f42-7308-9635-d7d347fdc433/ VirusTotal report: https://www.virustotal.com/gui/domain/www-balancer.fi Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=www-balancer.fi Archived copy: https://web.archive.org/web/20260902020138/https://www-balancer.fi/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:51:56 UTC ## Stored page captures - Primary capture: https://i.ibb.co/xt32z3MK/79c546c78d97.png Captured: 2026-09-02 02:00:08 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05fd6-8f42-7308-9635-d7d347fdc433.png Captured: 2026-09-02 02:00:08 UTC Source report: https://urlscan.io/result/01a05fd6-8f42-7308-9635-d7d347fdc433/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/91fa8a0d-d3c4-423d-9b57-f20db5c7fbdb.png Captured: 2026-09-02 02:10:03 UTC Source report: https://radar.cloudflare.com/scan/91fa8a0d-d3c4-423d-9b57-f20db5c7fbdb SHA-256: 28744ea2c7bbc7eaf78028ae2506316caafaccc6da995f2c55af8ac2ad355a4d - URLScan ยท 2026-09-02: https://screenshots.phishdestroy.io/us/01a05fd6-9b14-72ad-beec-8d0da09dff55.png Captured: 2026-09-02 01:58:21 UTC Source report: https://urlscan.io/result/01a05fd6-9b14-72ad-beec-8d0da09dff55/ SHA-256: 3797b896c2125a02eb2056043c64631a28beddeb3088471336ce3e74aea8d20f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:55:06Z", "uuid": "01a05fd6-8f42-7308-9635-d7d347fdc433", "scanned_at": "2026-09-02T01:58:25Z", "final_url": "https://www-balancer.fi/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://www-balancer.fi/", "from": "http://www-balancer.fi/", "status": 307 } ], "ip": "172.67.211.40", "domains": [ "images.unsplash.com", "fonts.gstatic.com", "static.cloudflareinsights.com", "fonts.googleapis.com" ], "ips": [ "172.253.124.94", "104.16.80.73", "151.101.194.208", "142.251.163.95", "172.67.211.40" ], "asns": [ "15169", "13335", "54113" ], "countries": [ "US" ], "doc_hash": "4d76b0a8a59799a11637be67f304361536ce5ddf3bee5d7082cdbb122e48993a", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8" ], "globals": [ "__cfBeacon", "observer" ], "tls": { "san": [ "www-balancer.fi", "*.www-balancer.fi" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "www-balancer.fi", "protocol": "QUIC", "valid_to": "2026-11-30T20:42:29Z", "valid_from": "2026-09-01T19:46:48Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 90, "requests": 21, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 91, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:35:28Z", "uuid": "91fa8a0d-d3c4-423d-9b57-f20db5c7fbdb", "scanned_at": "2026-09-02T02:10:03Z", "final_url": "https://www-balancer.fi/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://www-balancer.fi/", "status": 307 }, { "url": "https://www-balancer.fi/", "status": 200 } ], "dom_hash": "2da3a13ab2f36f52d1cb0958cff2f46a96d30caff8858d7a2b72fd093ca35264", "doc_hash": "8253fb04ac0fbc20cccc0bd007c325fb9a344e8b34e303836af8b9fb6106e0f1", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "dns": [ { "name": "www-balancer.fi", "type": "A", "value": "188.114.97.0" }, { "name": "www-balancer.fi", "type": "A", "value": "188.114.96.0" }, { "name": "www-balancer.fi", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "www-balancer.fi", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "188.114.97.0", "whois": { "created": "2026-09-01T19:40:52Z", "nameservers": [ "curt.ns.cloudflare.com [technical check not done]", "paris.ns.cloudflare.com [technical check not done]" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T08:16:48Z", "analysis_at": "2026-10-16T02:01:27Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 3, "suspicious": 2, "undetected": 35 }, "detections": { "CRDF": "malicious", "Fortinet": "spam", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "Xonet Oy", "expires": "2027-09-01T22:40:52Z", "first_seen": "2026-09-01T21:19:18Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "curt.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.83.39" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "curt.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:5327" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:d328" }, { "ttl": 300, "type": "A", "value": "172.67.211.40" }, { "ttl": 21600, "type": "NS", "value": "paris.ns.cloudflare.com" } ], "dns_at": "2026-10-16T02:01:40Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "www-balancer.fi", "*.www-balancer.fi" ], "issuer": "Google Trust Services / WE1", "serial": "90df3eec93c945320ee3f4d24f4b07c9", "sha256": "464a680a29fedb5787b668a7efb270ff9fcee1ce98b27638181a48908a9dca5b", "subject": "www-balancer.fi", "valid_to": "2026-11-30T20:42:29Z", "valid_from": "2026-09-01T19:46:48Z" }, "whois": { "registrar": "Xonet Oy", "dnssec": "no" }, "rdap": { "status": [ "active" ], "events": { "expiration": "2027-09-01T19:40:52Z", "last changed": "2026-09-01T20:11:40Z", "registration": "2026-09-01T19:40:52Z", "last update of RDAP database": "2026-10-16T01:48:23Z" } } } } ```