dev[.]bahusande[.]com

This domain, dev.bahusande.com, poses a high-risk threat by impersonating the Aave decentralized finance platform to facilitate crypto wallet credential theft. Analysis indicates the infrastructure was designed to mimic legitimate wallet interfaces, specifically targeting users of the Aave protocol. The page title, 'Coinbase Wallet - Your key to the world of crypto,' suggests an attempt to deceive victims into believing they are interacting with a trusted wallet provider, potentially leading to unauthorized access to cryptocurrency holdings or seed phrase compromise. Infrastructure analysis reveals the domain was registered on October 07, 2025, through ENOM, INC., and resolves to the IP address 190.115.21.159, hosted under AS59692 IQWeb FZ-LLC in Belize. The domain lacks an SSL certificate, increasing the risk of interception or tampering. Security vendors flagged this domain on VirusTotal, with 18 out of 95 engines detecting malicious activity. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is marked as phishing by Google Safe Browsing. These indicators confirm its malicious intent and operational focus on brand impersonation. Users who visited dev.bahusande.com should immediately revoke any wallet permissions granted during the interaction and transfer assets to a new, secure wallet. It is critical to scan the device used to access the domain for malware, as credential theft often involves secondary payloads. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If sensitive information such as seed phrases or private keys was entered, assume full compromise of the associated wallets and take immediate action to secure remaining assets.