debank[.]com-walletv2-api-app[.]com

This domain, debank.com-walletv2-api-app.com, was registered on 21 February 2026 and resolves to the Cloudflare address 172.67.136.168 located in the United States under ASN 13335. The hosting provider is Cloudflare, Inc. The site is currently taken offline, but historical analysis shows that it was flagged by multiple security services. VirusTotal records indicate that 13 of 93 scanning engines flagged the domain as malicious. PhishDestroy lists the domain as blocked, and it appears on a single external security blocklist.

Gridinsoft assigned a trust score of 0 out of 100, confirming a high confidence of malicious intent. The SSL certificate presented for the host is identified as “WE1”, which does not correspond to a reputable certificate authority and further weakens the site’s credibility. The threat classification supplied is “Crypto Scam”, specifically a crypto drainer aimed at users of the DeBank platform. The naming pattern combines the legitimate brand “debank.com” with additional path‑like segments “walletv2‑api‑app.com”, a technique commonly used to exploit user familiarity and trick victims into believing the URL belongs to the official service.

No additional artefacts such as page titles, redirects, or payload samples have been released, so the exact delivery mechanism remains unknown. Defenders should immediately add the domain and its associated IP address to deny‑list rules in perimeter firewalls, DNS filtering solutions, and endpoint protection products. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advised, as the attacker may reuse the same infrastructure for future campaigns. Because the domain is already offline, incident response can focus on containment of any credentials or cryptocurrency addresses that may have been exposed prior to takedown and on user education to avoid similar deceptive sub‑domains that mimic legitimate DeBank URLs.