dbanks[.]now[.]sh

This domain, dbanks.now.sh, is actively impersonating DeBank, a Web3 portfolio tracker and messenger platform, as indicated by the page title 'Login | DeBank | The Web3 Messenger & Best Web3 Portfolio Tracker.' Analysis confirms the domain is flagged for brand impersonation with a high-risk classification. Infrastructure analysis reveals it resolves to IP address 64.29.17.67 and was registered on January 30, 2022. The domain is hosted on Vercel infrastructure and employs HSTS, with an SSL certificate issued by Google Trust Services. Security vendor detections include 16 flags from a VirusTotal scan, and it appears on at least one security blocklist, with additional blocking by PhishDestroy. The Gridinsoft trust score of 0/100 further supports the malicious classification. Defenders should treat this domain as a confirmed phishing endpoint targeting DeBank users. Immediate action is recommended, including blocking the domain and IP at perimeter security controls, monitoring for credential theft or wallet-draining attempts linked to this infrastructure, and alerting users to avoid interaction. The exact content or functionality of the phishing page remains unanalyzed, but the combination of brand impersonation, active status, and security vendor detections justifies a high-confidence malicious assessment.