balancealign[.]live

Analysis of the domain balancealign.live indicates it was actively involved in a fraudulent scheme impersonating YouTube's copyright claim review process, as evidenced by its page title 'Copyright Claim Review — YouTube'. The domain was registered on March 22, 2026, through Global Domain Group LLC and hosted on infrastructure provided by RackNerd LLC, resolving to the IP address 198.23.210.58. Cloudflare nameservers (nelly.ns.cloudflare.com and drake.ns.cloudflare.com) were employed, a common tactic to obscure hosting origins and evade takedowns. A Let's Encrypt SSL certificate (R12) was present, providing a superficial layer of legitimacy while failing to mitigate the underlying fraudulent intent.

Security vendors flagged the domain with moderate consensus: four out of 94 engines on VirusTotal detected malicious activity, and it appeared on one security blocklist, specifically PhishDestroy. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk entity. While the domain is currently offline, its infrastructure remains a potential vector for future malicious campaigns. Defenders should monitor for re-registration or IP reuse, particularly within the same hosting provider (ASN associated with RackNerd LLC).

The exact mechanics of the scam—whether it involved credential harvesting, malware distribution, or financial fraud—are not fully analysed due to the site's offline status. However, the page title explicitly targets YouTube creators, suggesting a focus on exploiting copyright claim anxieties to deceive victims. No evidence of a phishing kit or additional brand impersonation was identified in the available data.