balanceindexequity[.]com

Analysis of balanceindexequity.com shows a recently registered domain (created 28 April 2026) that is actively serving web content (HTTP 200) from IP 185.191.124.15, a server located in the Netherlands and associated with Amarutu Technology Ltd. Network. The domain is delegated to ns19.nlkoddos.com and ns20.nlkoddos.com, both of which are known to host malicious actors. The TLS certificate presented is issued to balanceindexequity.com.skyvault.ltd, a pattern frequently observed in phishing infrastructure. The site runs PHP with Bootstrap and Lightbox libraries and is fronted by Cloudflare, including Cloudflare Browser Insights and HTTP/3 support. Threat intelligence reports indicate that four of ninety‑one VirusTotal scanners flagged the domain, a Gridinsoft trust score of 0/100, and inclusion on a security blocklist that is also used by PhishDestroy. AlienVault OTX lists the domain in one pulse. The combination of recent registration, low trust scores, multiple vendor detections, and blocklist presence suggests a high‑confidence phishing operation. Uncertainty remains regarding the specific phishing lure or targeted victims, as page content has not been examined. Defenders should block or sinkhole 185.191.124.15 at the network perimeter, add the domain to URL filtering and email security policies, monitor DNS queries for the domain and its nameservers, and continue to track any new intelligence from threat feeds.