event-balancer[.]xyz

This domain is flagged as an active brand impersonation threat targeting the Balancer decentralized finance protocol. Analysis confirms the domain was registered on March 13, 2026, through Dynadot LLC, and currently resolves to IP address 172.67.165.115, hosted on Cloudflare infrastructure (AS13335) in the United States. The domain employs Cloudflare nameservers (aragorn.ns.cloudflare.com and roxy.ns.cloudflare.com) and is secured with a Let's Encrypt SSL certificate (E8). The page title displays a 504 Gateway Time-out error, while the HTTP response status is 403 Forbidden, indicating the site may be configured to block direct access or is currently non-functional for certain visitors. The Gridinsoft trust score is 0/100, reflecting high suspicion. VirusTotal data shows 2 out of 95 security vendors flagging this domain as malicious, and it appears on three separate security blocklists. The domain is currently blocked by PhishDestroy, MetaMask, and SEAL security services. The domain is still active and accessible, though the 403 status suggests potential access controls are in place. The exact phishing mechanism deployed is uncertain due to the gateway error page, but the domain name directly incorporates the target brand name 'Balancer' and uses the .xyz TLD, a common pattern in brand impersonation campaigns. Defenders should add this domain to blocklists immediately, monitor for related subdomains or similar patterns, and verify that no legitimate Balancer infrastructure is affected. Users should be warned not to interact with this domain or any communications directing traffic to it. The registration date of March 2026, combined with current active status, indicates this threat has persisted for approximately four months without takedown.