api[.]bahusande[.]com

This domain is flagged as a high-risk brand impersonation threat specifically targeting Aave, a decentralized finance protocol. The site masquerades as Coinbase Wallet, a tactic commonly used to deceive users into entering sensitive credentials or approving malicious transactions, potentially leading to unauthorized access or asset theft.

Analysis indicates the domain was registered on October 7, 2025, through ENOM, INC., and resolves to the IP address 190.115.21.159, hosted in Belize (AS59962 IQWeb FZ-LLC). It appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal reports 18 out of 95 security vendors detecting malicious activity associated with this domain. Notably, the site lacks an SSL certificate, increasing the risk of interception or tampering during data transmission. The page title, "Coinbase Wallet - Your key to the world of crypto," further confirms the intent to impersonate a legitimate service.

Mitigation steps include immediately blocking the domain and its associated IP (190.115.21.159) at the network level. Users who may have interacted with the site should revoke any active wallet approvals or sessions linked to Aave or Coinbase Wallet, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update detection rules to include this domain and its indicators of compromise (IoCs) in threat intelligence feeds. Given the high-risk nature of this threat, proactive communication to users about recognizing brand impersonation tactics is recommended.