Slow Mist: Balancer’s BGP attack is still ongoing. It is recommended to temporarily stop accessing its official website.

Odaily Planet Daily News According to Slow Mist Zone intelligence, Balancer is suffering from BGP Hijacking attacks. After accessing the website to link the wallet, you will be subject to phishing attacks. According to CloudFlare's BGP Origin Hijack-17957, the ASNs victim list contains AS13335 to which Balancer belongs. Currently, when you visit this website, you will receive a phishing safety alert from CloudFlare. The following is the SlowMist security team’s analysis of this incident: 1. Query the DNS resolution record of the domain name balancer.fi (https://bgp.tools/dns/balancer.fi). The addresses in the A record are 104.21.37.47 and 172.67.203.244. The BGP AS area number of these two IP addresses is AS13335, and the AS belongs to CloudFlare. 2. According to CloudFlare’s records (https://radar.cloudflare.com/routing/anomalies/hijack-17957), AS13335 is in the AS list attacked by BGP Origin Hijack. 3. It was found that the HTTPS certificate of balancer.fi was replaced with the attacker’s certificate. 4. Currently, when you visit https://app.balancer.fi, you will receive a phishing security reminder from CloudFlare. 5. After analysis, there is malicious JavaScript code in the front end of app.balancer.fi (https://app.balancer.fi/js/overchunk.js). 6. The user uses the wallet to connect app.balancer.fi. The malicious script will automatically determine the balance and conduct phishing attacks. 7. After MistTrack analysis, the malicious addresses are as follows: 0x00006DEAcd9ad19dB3d81F8410EA2B45eA570000 0x645710Af050E26bB96e295bdfB75B4a878088d7E 0x0000626d6DC72989e3809920C67D01a7fe030000 The SlowMist security team reminds users that BGP attacks against Balancer are still ongoing. Please temporarily stop accessing Balancer's website to avoid being attacked.