docs-v2-balancer-fi[.]typedream[.]app

Analysis of the domain docs-v2-balancer-fi.typedream.app, created on 21 February 2026, shows infrastructure consistent with a Balancer brand impersonation campaign. The host resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. DNS registration lists Squarespace Domains II LLC as the registrar, and the TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid‑looking HTTPS presentation. Web‑technology fingerprinting identifies a stack built on Node.js, React, Next.js, and Google Cloud services, supplemented by Cloudflare Browser Insights and CDN, which is typical for rapidly deployed phishing sites.

The page title returned by the server is “Home | Balancer”, directly referencing the targeted brand, and the HTTP response code is 404, suggesting the site is presently unavailable or deliberately taken offline. VirusTotal scans recorded two detections out of 93 scanners, and the domain appears on a single external blocklist. PhishDestroy has already taken the site down.

Current evidence points to a brand‑impersonation scheme aimed at deceiving Balancer users, but the exact malicious payload or credential‑harvesting mechanism has not been observed because the site returns no content. Defenders should add the domain and its IP address to URL and DNS filtering rules, monitor other subdomains under typedream.app for similar technology footprints, and enforce strict verification of any Balancer‑related communications. Continuous re‑scanning of the host is advised to detect any re‑activation, and intrusion‑detection systems should flag attempts to contact the Cloudflare‑served IP from internal networks.