debank[.]ink

Analysis of debank.ink shows a high‑risk banking phishing infrastructure that was taken offline prior to the report date of July 24, 2026. The domain was registered through Porkbun LLC on July 07, 2025 and resolves to the IP address 44.227.76.166, which belongs to Amazon.com, Inc. (AS16509) and is geographically located in the United States. No SSL certificate is present, and the HTTP response returns status code 200 with a page title of "porkbun.com | parked domain," indicating that the site currently serves only a registrar‑provided parking page.

VirusTotal scans flagged the domain by 10 of 95 security vendors, and Google Safe Browsing categorises it as a social‑engineering threat. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, further confirming its malicious intent. While the observed evidence points to a classic banking phishing campaign, the exact payload, credential‑capture mechanisms, and any redirect infrastructure remain unverified because the site is offline and only a parked page is visible.

Defenders should continue to block the domain and its associated IP address at perimeter and endpoint controls, monitor for re‑registration or similar domains using the same registrar or hosting provider, and consider adding the domain to internal threat intelligence feeds. Ongoing surveillance of the Amazon AS16509 range for new phishing‑related activity is advised, as is periodic re‑scanning should the domain become active again.