balancer-fi-finance[.]pages[.]dev

The domain balancer-fi-finance.pages.dev is currently active and engaged in brand impersonation targeting the Across decentralized finance protocol. Analysis indicates this infrastructure is designed to function as a crypto drainer, tricking users into connecting wallets to malicious smart contracts under the guise of a legitimate liquidity platform. The page title, 'Balancer Finance – Smart DeFi Liquidity Platform,' explicitly mimics established DeFi services to lend credibility to the fraudulent operation. Infrastructure analysis reveals the domain was registered on August 23, 2025, through Cloudflare, Inc. and resolves to the IP address 172.66.46.215, geolocated within the United States under AS13335 (Cloudflare, Inc.). The domain appears on one security blocklist and is flagged by 1 of 95 VirusTotal security vendors. An SSL certificate issued by Google Trust Services (WE1) provides HTTPS encryption, further obscuring the malicious nature of the site from casual inspection. The combination of recent registration, Cloudflare hosting, and minimal detection suggests an attempt to evade automated security systems. Current status remains active, posing a high risk to users of the Across protocol and the broader DeFi community. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users should verify all DeFi interactions through official protocol channels and employ wallet transaction simulation tools to inspect contract behavior before approval. Security teams are encouraged to monitor for additional domains leveraging the 'pages.dev' subdomain infrastructure, as this pattern has been observed in prior crypto drainer campaigns.