demo[.]bahusande[.]com

This domain, demo.bahusande.com, is flagged as a high-risk brand impersonation threat targeting Aave, a decentralized finance protocol. Analysis indicates the domain was designed to mimic legitimate cryptocurrency wallet services, specifically presenting a page titled 'Coinbase Wallet - Your key to the world of crypto.' The intent appears to be credential harvesting or wallet compromise, though no explicit drainer kit signatures were identified in the available telemetry. The domain exhibits characteristics consistent with phishing infrastructure, including the absence of an SSL certificate and a deceptive page title impersonating a trusted platform. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 190.115.21.159, hosted under AS59692 (IQWeb FZ-LLC) in Belize. It was registered on October 07, 2025, through ENOM, INC. Google Safe Browsing explicitly flags the domain as phishing. At the time of analysis, 18 out of 95 security vendors on VirusTotal detected the domain as malicious. The domain appears on two distinct security blocklists: PhishDestroy and PhishingDB. No valid SSL certificate was observed, increasing the likelihood of interception or manipulation of user data in transit. As of the latest assessment, demo.bahusande.com has been taken offline, reducing immediate exposure risk. However, residual risk remains due to the domain's recent creation date and the potential for infrastructure reuse. Organizations and users are advised to block the domain and its associated IP at the network perimeter. Security teams should monitor for any re-registration or re-emergence of the domain under alternate TLDs or subdomains. Users who may have interacted with the domain should revoke any connected wallet permissions and rotate credentials associated with cryptocurrency services.