fundacionbuenaventura[.]cl

The domain fundacionbuenaventura.cl has been confirmed as a brand impersonation threat targeting Aave, a decentralized finance protocol. Analysis indicates the site was designed to deceive users into interacting with fraudulent crypto-related services, likely through social engineering tactics. The domain is currently offline, but prior activity suggests it operated as part of a broader campaign to exploit trust in the Aave brand. Infrastructure analysis reveals the domain was registered through NIC Chile and resolved to the IP address 162.215.8.235, hosted on AS46606 (Unified Layer) in the United States. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. Security vendors flagged the domain in 10 of 95 VirusTotal scans, and it appeared on one security blocklist prior to takedown. The page title, 'Webhosting en Chile | Hosting en Chile | Hosting Linux Php | Hosting Windows Asp,' does not align with Aave's branding, further indicating malicious intent. While the domain is currently offline, the infrastructure and tactics observed warrant continued monitoring. Organizations and users should treat any future resolutions of this domain as high-risk. Immediate actions include blocking the domain and IP at the network level, updating detection rules to include the SSL certificate thumbprint, and alerting users to the impersonation risk. Historical WHOIS data and passive DNS records should be preserved for further investigation if the domain resurfaces.