starteed-balancer-protocol[.]pages[.]dev

This domain, starteed-balancer-protocol.pages.dev, is actively impersonating the Balancer protocol, a decentralized finance platform, to deceive users into disclosing sensitive credentials or interacting with malicious smart contracts. The page mimics legitimate Balancer login and exchange interfaces, presenting itself as an official guide for troubleshooting and access. Such brand impersonation typically aims to harvest wallet credentials, seed phrases, or trick users into approving unauthorized transactions, leading to potential asset theft or account compromise. Analysis indicates the domain was registered on April 19, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.46.237, hosted in Canada under Cloudflare infrastructure. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare services. The domain appears on one security blocklist and is flagged by 1 out of 95 security vendors on VirusTotal, suggesting limited but confirmed detection. The page title, 'Balancer ® Protocol — Guide: Login, Exchange & Troubleshooting,' reinforces the impersonation by explicitly referencing Balancer’s branding and core functionalities. Users who have visited starteed-balancer-protocol.pages.dev or interacted with its content should immediately revoke any smart contract approvals granted during the session using a trusted wallet interface. All credentials, private keys, or seed phrases entered on the site must be considered compromised and should be migrated to new, secure wallets. Monitor connected accounts for unauthorized transactions and report the domain to relevant security teams or blocklist providers. Infrastructure analysis reveals the use of Cloudflare Pages, a platform often abused for rapid deployment of phishing sites, underscoring the need for heightened scrutiny of domains hosted on similar services.