bluefin[.]airdrpsalerts[.]cfd

The domain bluefin.airdrpsalerts.cfd is a confirmed phishing site engaged in brand impersonation targeting Google. It presents a fraudulent login page designed to harvest user credentials under the guise of a legitimate Google service. No crypto drainer kit was detected, but the site poses an elevated risk due to its deceptive appearance and active credential theft attempts. As of the latest verification, bluefin.airdrpsalerts.cfd has been taken offline.

Technical analysis reveals that bluefin.airdrpsalerts.cfd was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on October 29, 2025, and resolves to the IPv6 address 2607:f8b0:4004:c07::67, hosted on Google LLC's infrastructure (AS15169). It appears on 1 security blocklist, specifically PhishDestroy, and lacks an SSL certificate. The observed page title was 'Google', reinforcing its impersonation of the legitimate brand. Nameservers are hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com).

Users who interacted with bluefin.airdrpsalerts.cfd should immediately change their Google account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor account activity for signs of fraud, such as unfamiliar logins or transactions. Report the phishing domain to Google’s abuse team via their reporting form and to platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts. If financial or sensitive data was entered, consider contacting relevant institutions to secure accounts.