testing[.]bahusande[.]com

The domain testing.bahusande.com was registered on October 07 2025 through ENOM, INC. and is currently listed as taken offline by PhishDestroy. Infrastructure analysis shows the domain resolves to IP address 190.115.21.159, which is assigned to AS59692 IQWeb FZ-LLC and geolocated to Belize. The name server configuration points to ns1.ddos-guard.net and ns2.ddos-guard.net, both of which are commonly observed in malicious hosting setups. No TLS certificate is presented for the site, indicating that any traffic would be transmitted over clear‑text HTTP, a typical characteristic of fraudulent deployments. The Gridinsoft trust score is 0 out of 100, reinforcing the low credibility of the host.

The page title returned by the server reads “Coinbase Wallet – Your key to the world of crypto,” while the documented impersonated brand is Aave, and the overall scam classification is a crypto scam. VirusTotal scans have flagged the domain in 16 of 95 security vendor engines, and the domain appears on at least one external blocklist. These data points collectively confirm that the site was designed to lure users with a cryptocurrency‑related message while masquerading as an Aave‑related service. Defenders should treat any traffic to testing.bahusande.com as malicious. Block the domain and its resolving IP (190.115.21.159) at perimeter firewalls and DNS filtering solutions.

Because the site lacks an SSL certificate, man‑in‑the‑middle inspection can be applied without TLS decryption concerns. Monitor for any new DNS records or changes to the name servers that might indicate a re‑activation attempt. Given the association with a known phishing takedown service (PhishDestroy) and the presence on a security blocklist, automated threat feeds should be updated to include this indicator set. Continuous observation of the IP’s ASN (AS59692) for additional suspicious activity is advisable, as the hosting provider may be leveraged for other fraudulent campaigns.