bendavo[.]su

This domain, bendavo.su, is identified as a high-risk phishing infrastructure specifically designed to compromise cryptocurrency wallet credentials. Analysis indicates the site impersonates legitimate wallet interfaces, tricking users into entering private keys or seed phrases, which are then exfiltrated to attacker-controlled servers. The threat primarily targets users of decentralized finance (DeFi) platforms and self-custody wallets, where credential theft can result in immediate and irreversible asset loss. The domain’s design and functionality closely resemble authentic wallet services, increasing the likelihood of successful deception among less vigilant users. Infrastructure analysis reveals the domain was registered on March 26, 2026, through an anonymized registrar, a common tactic to obscure ownership and delay takedown efforts. As of the latest assessment, bendavo.su is flagged by 20 out of 95 security vendors on VirusTotal, indicating a broad consensus on its malicious nature. Additionally, the domain appears on four distinct security blocklists, further corroborating its classification as a phishing threat. The combination of recent registration, widespread detection, and blocklist inclusion underscores the domain’s active role in ongoing credential harvesting campaigns. Users who have interacted with bendavo.su are advised to take immediate remedial action. First, revoke any wallet permissions or connected applications associated with the domain via the wallet’s settings or a blockchain explorer. Second, transfer assets to a new wallet with a fresh seed phrase, as compromised credentials may still be exploited even after the domain is offline. Finally, monitor transaction histories for unauthorized activity and report the incident to relevant security teams or platforms to aid in broader mitigation efforts. Given the high-risk nature of this threat, affected users should assume their credentials are compromised and act accordingly.