staging[.]bahusande[.]com

staging.bahusande.com was registered through ENOM, INC. on 2025-10-07. The domain resolves to 190.115.21.159, an address located in Belize and announced as belonging to ASN 59692 (IQWeb FZ-LLC). Nameservers ns1.ddos-guard.net and ns2.ddos-guard.net are present, suggesting use of a DDoS‑mitigation service. No TLS certificate is served, indicating the site is reachable only over plain HTTP.

The site is currently taken offline, as indicated by the “offline” status and the fact that it has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal reports that 17 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion. The observed page title reads “Coinbase Wallet – Your key to the world of crypto”, while the intelligence tags the campaign as a crypto‑scam impersonating the Aave brand. This combination of brand impersonation, a misleading wallet‑related title, and low trust metrics aligns with the classification of a crypto‑related fraud.

Defenders should continue to block any DNS resolution to 190.115.21.159 and add the domain to local and network‑level deny lists. Monitoring of the associated IP and the hosting ASN for any re‑activation is advised, as is periodic re‑scanning on VirusTotal or similar services to capture potential changes. Because the site lacks SSL, any attempted HTTP connections can be intercepted or logged for further forensic analysis, but no additional content has been captured. At this time, the primary indication of malicious intent derives from the brand impersonation, low trust score, blocklist presence, and multi‑vendor detections; further investigation should focus on any payloads or credential‑harvesting pages that may have existed before takedown.