deefi--balancer-access[.]pages[.]dev

PhishDestroy identifies deefi--balancer-access.pages.dev as an active brand impersonation phishing domain targeting Balancer users. The domain mimics Balancer’s branding to deceive victims into entering credentials or connecting wallets, likely as part of a drainer kit designed to siphon cryptocurrency assets. The infrastructure is hosted on Cloudflare Pages, leveraging Google Trust Services SSL certificates to appear legitimate. This domain was flagged due to its high-risk impersonation tactics and lack of verifiable connection to Balancer’s official domains.

Technical indicators reveal this domain was registered via Cloudflare, Inc., resolving to IP 188.114.96.3 with a VirusTotal detection score of 4/95 as of the latest scan. The domain uses a Google Trust Services SSL certificate, which may help it bypass basic browser warnings. At the time of analysis, this domain remains unblocked by major security vendors, including Google Safe Browsing (GSB), and has not been flagged on any known blocklists. The lack of detections suggests this campaign is either newly deployed or employs evasion techniques to avoid signature-based detection.

The current status of deefi--balancer-access.pages.dev is active, with an under_investigation risk level pending further analysis. Immediate recommendations include blocking the domain at the network level and advising users to avoid interacting with unsolicited links. While the immediate risk is mitigated by low detection rates, the threat remains significant due to its potential to deceive users. Security teams should monitor for associated wallet addresses or drainer scripts linked to this domain. Remaining risk is classified as high due to the likelihood of future iterations or related infrastructure deployment.