portal[.]bahusande[.]com

Analysis of portal.bahusande.com shows a newly registered domain (creation date October 07 2025) that is currently taken offline but was previously used in a crypto‑related impersonation campaign targeting the Aave brand. The domain was registered through ENOM, INC. and resolves to the IP address 190.115.21.159, which is assigned to ASN 59692 (IQWeb FZ‑LLC) in Belize. No TLS certificate was observed, indicating that the site operated over plain HTTP.

The authoritative nameservers ns1.ddos-guard.net and ns2.ddos-guard.net suggest the use of a DDoS‑mitigation service, a common tactic for malicious infrastructure. The page title returned by the host was "Coinbase Wallet – Your key to the world of crypto," aligning with the reported scam type of a crypto scam and the Seed Phrase Phishing kit identified in the intelligence. The domain appears on a single security blocklist and has been flagged by PhishDestroy, confirming its malicious status. VirusTotal scans recorded 17 detections out of 95 security vendors, providing corroborating evidence of its abusive nature.

While the offline status limits immediate traffic observation, the combination of a brand impersonation label (Aave), a cryptocurrency‑focused page title, and the seed‑phrase phishing kit indicates a targeted attempt to harvest private keys or seed phrases from users seeking Aave services. Defenders should block the domain at network perimeter devices, update URL filtering and DNS threat feeds to include portal.bahusande.com, and monitor for any residual connections to the IP 190.115.21.159. Further investigation of the hosting provider IQWeb FZ‑LLC may uncover additional related infrastructure. The lack of HTTPS and the use of DDoS‑guard nameservers are notable indicators for future detection heuristics.