bluefin[.]beefy[.]bar

Analysis of the domain bluefin.beefy.bar shows a newly registered internet property created on October 01, 2025 and registered through Dynadot LLC. The domain is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and resolves to the address 192.178.155.99, which is mapped to the United States and attributed to Autonomous System AS15169 owned by Google LLC. Despite the legitimate hosting attribution, the site presents a page title of "Google" and is explicitly classified as a brand‑impersonation campaign targeting Google. No Transport Layer Security certificate is observed for the domain, and the current operational state is offline, indicating that the site has been taken down or is otherwise inaccessible.

Reputation services provide a consistent negative assessment: Scamadviser assigns a trust score of 1 out of 100, Gridinsoft rates the domain at 0 out of 100, and the domain appears on one security blocklist where it has been blocked by the PhishDestroy service. VirusTotal scans report that nine of ninety‑five security vendors flagged the domain as malicious, reinforcing the suspicion of malicious intent. No additional public threat‑intelligence sources such as OTX, Safe Browsing, or similar are referenced in the available data.

The concrete evidence points to a deliberate attempt to masquerade as a Google resource, leveraging a Google‑owned IP range to increase perceived legitimacy while lacking proper HTTPS protection. Uncertainties remain regarding the specific payload or credential‑harvesting mechanisms, as the site is offline and no detailed page content has been captured. Defenders should treat bluefin.beefy.bar as a high‑confidence malicious indicator, add the domain to DNS‑level blocklists, monitor for any future re‑registration or infrastructure changes, and remain vigilant for related domains that may use similar naming patterns or Cloudflare name server configurations.