balaancer-dex-us[.]pages[.]dev

PhishDestroy identifies balaancer-dex-us.pages.dev as an active cryptocurrency exchange phishing domain designed to trick users into connecting their digital wallets and stealing crypto funds. The site masquerades as a legitimate decentralized exchange, luring victims with promises of low fees or exclusive tokens. Once a victim connects a wallet through the embedded interface, the operators immediately drain the wallet of all supported assets. This type of scam is commonly distributed via social media ads, spoofed Discord servers, or phishing emails that mimic legitimate DeFi projects. This domain was flagged by PhishDestroy after VirusTotal scanning revealed that only 1 out of 95 security vendors currently detects the threat. The site is served from Cloudflare Pages at IP address 188.114.97.3, and its SSL certificate is issued by Google Trust Services, which adds a veneer of legitimacy. The domain leverages Cloudflare’s free hosting and trusted SSL to bypass browser warnings. Based on telemetry and campaign patterns, the infrastructure appears to have been activated very recently, increasing the risk of newly compromised users falling victim. If you visited or used balaancer-dex-us.pages.dev, disconnect your wallet immediately using your wallet’s built-in connection manager or browser extension. Revoke any token approvals via reputable tools like revoke.cash or Etherscan’s approval checker. Scan your device with an updated antivirus and consider rotating private keys or using a new wallet for future transactions. Report the domain to your browser, wallet provider, and local cybercrime units. Always verify URLs against official project websites and avoid clicking ads or links from untrusted sources. Using hardware wallets and enabling transaction simulation features can further reduce risk in high-value interactions.