# PhishDestroy domain threat record: duplicate-disabled-685.invalid

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/duplicate-disabled-685.invalid/
Machine-readable companion: https://phishdestroy.io/domain/duplicate-disabled-685.invalid/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2025-08-09 11:11:57 UTC
- Last availability or vendor check: 2026-10-21 01:15:24 UTC
- Stored record updated: 2026-10-22 14:22:01 UTC
- VirusTotal detections in the stored snapshot: 9/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: debank

## Stored infrastructure

- Observed IP address: 165.22.123.139
- Registrar in stored WHOIS data: 1API GmbH
- Registrar country in stored WHOIS data: DE

## Evidence links

- URLScan report: https://urlscan.io/result/01988f9a-4f24-7528-a2a2-db0c2ffbf62b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/duplicate-disabled-685.invalid
- Certificate Transparency search: https://crt.sh/?q=%25.duplicate-disabled-685.invalid
- Web Archive lookup: https://web.archive.org/web/*/https://duplicate-disabled-685.invalid/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

{"en": "This domain, www.debank.app, was observed serving an HTTP 200 response with the page title “DeBank dot App: premium domain name (Buy now) - debank.app”. The site is hosted on a DigitalOcean server (AS14061) located in Great Britain and resolves to IP 165.22.123.139. Infrastructure fingerprints include Apache HTTP Server, jQuery UI and jQuery libraries. The SSL certificate is issued by Let’s Encrypt (R13), indicating standard automated TLS provisioning. Reputation scoring from Gridinsoft rates the domain at 0 / 100, and the site is currently reported as taken offline.\n\nMalware and phishing detection services on VirusTotal flagged the domain in five of ninety‑five scans, and the domain appears on a single external blocklist. It is listed as a “Banking Phishing” campaign that impersonates the legitimate DeBank brand. The registration record shows the registrar 1API GmbH and the authoritative nameservers ns1.premiumdomains.cloud and ns2.premiumdomains.cloud. PhishDestroy has actively blocked the domain. Analysis confirms that the observed indicators align with a brand‑impersonation phishing infrastructure targeting users of the DeBank service.\n\nHowever, the site’s current offline status limits real‑time verification of malicious content, and the limited blocklist presence suggests modest detection coverage. Defenders should add the domain to internal blocklists, monitor the associated IP range (165.22.123.0/24) for future activity, and enforce TLS inspection to capture any credential submissions if the site reappears. Continuous scanning with multi‑vendor services is advised to detect any changes in the detection ratio on VirusTotal. Organizations that use DeBank services should educate users about the risk of unsolicited domain offers and encourage verification of official URLs.", "pt-br": "Hello! How can I help you today?"}
Analysis generated: 2026-07-24 23:34:02 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01988f9a-4f24-7528-a2a2-db0c2ffbf62b.png
  Captured: 2026-03-05 23:06:41 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01988f9a-4f24-7528-a2a2-db0c2ffbf62b.png
  Captured: 2026-03-05 23:06:41 UTC
  Source report: https://urlscan.io/result/01988f9a-4f24-7528-a2a2-db0c2ffbf62b/