balncer-dex[.]typedream[.]app

Analysis of balncer-dex.typedream.app shows a newly registered domain (creation date February 21, 2026) that is actively leveraged for brand impersonation targeting Aave users. The site resolves to 188.114.96.3, an IP address owned by Cloudflare (AS13335) and located in the United States. DNS resolution is performed through Squarespace Domains II LLC, suggesting the domain was purchased via a popular SaaS registrar. The HTTPS certificate is issued by Google Trust Services under the WE1 designation, confirming a valid TLS handshake despite the site’s malicious intent.

HTTP responses return a 403 status code, and the domain is currently taken offline, but historical activity indicates it was serving a page titled "Balancer DEX - Decentralized Exchange & AMM," a title that does not align with the Aave brand and likely served to lure cryptocurrency users. Infrastructure fingerprints reveal a modern web stack: Node.js, React, Next.js, Google Cloud services (Trace and CDN), Cloudflare edge protection, and Webpack bundling, all typical of legitimate DeFi front‑ends, which may have been used to obscure the underlying phishing payload. Threat intelligence sources flag the domain as a wallet/seed phishing operation, and two of ninety‑three VirusTotal scanners have raised detections. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, currently blocked by PhishDestroy.

While the exact content of the phishing page has not been publicly disclosed, the combination of brand impersonation, deceptive page title, and low trust metrics indicates a high likelihood of credential or seed phrase harvesting. Defenders should update URL filtering rules to block balncer-dex.typedream.app, monitor for related DNS queries, and educate users that legitimate Aave services never use the "balncer-dex" subdomain or a typedream.app suffix.