login[.]bahusande[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Aave, a decentralized finance protocol. The site masquerades as a legitimate crypto wallet service, specifically mimicking Coinbase Wallet, to deceive users into disclosing sensitive credentials or transferring digital assets to attacker-controlled addresses. Analysis indicates the domain was registered on October 07, 2025, through ENOM, INC., and resolves to the IP address 190.115.21.159, located in Belize under AS59692 (IQWeb FZ-LLC). The infrastructure lacks an SSL certificate, a critical security red flag for financial services. Detection engines on VirusTotal flagged the domain as malicious, with 18 out of 95 vendors confirming phishing activity. The domain appears on one security blocklist and is blocked by PhishDestroy. Google Safe Browsing also classifies the site as phishing, reinforcing its fraudulent nature. Mitigation steps for this specific threat type include immediate blacklisting of the domain and IP across all network security controls. Organizations should update endpoint detection rules to flag any attempts to access login.bahusande.com or its associated IP. Users who may have interacted with the site should revoke any active sessions, rotate credentials, and monitor blockchain transactions for unauthorized activity. Given the domain's impersonation of Aave, decentralized finance platforms should issue public advisories to their communities, emphasizing verification of official URLs and the use of hardware wallets for sensitive operations.