debank[.]com-wallet-api-v2-connect[.]com

The domain debank.com-wallet-api-v2-connect.com is a phishing site designed to function as a crypto drainer, a type of scam that automatically siphons cryptocurrency from connected wallets without user consent. It does not impersonate a specific legitimate brand or use a known drainer kit. As of the latest verification, the site has been taken offline, but prior activity indicates an elevated risk to users who may have interacted with it.

Technical indicators confirm the domain's malicious intent. debank.com-wallet-api-v2-connect.com was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and Fortinet. It appears on 2 security blocklists, PhishDestroy and ScamSniffer, but was not flagged by Google Safe Browsing. The domain was registered on February 21, 2026, through MAT BAO CORPORATION and resolves to the IP address 172.67.187.37, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate was issued by Google Trust Services / WE1, and the observed page title was 'com-wallet-api-v2-connect.com | 521: Web server is down'. Nameservers are aragorn.ns.cloudflare.com and kayleigh.ns.cloudflare.com.

Users who may have connected a wallet to debank.com-wallet-api-v2-connect.com should immediately revoke all token approvals using a tool like Revoke.cash or Etherscan's token approval checker. Funds should be moved to a new wallet to prevent further unauthorized transactions. Victims are advised to report the domain to their wallet provider, local cybercrime authorities, and platforms like ScamAdviser or the Anti-Phishing Working Group (APWG) to aid in tracking and mitigation efforts.