bluefin[.]airdrpalerts[.]cfd

This domain, bluefin.airdrpalerts.cfd, was observed hosting a brand‑impersonation page targeting Google. The domain was created on 25 October 2025 and is registered through Dynadot LLC. DNS resolution points to 142.250.185.164, an address owned by AS15169 Google LLC and located in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was presented during connection attempts, which is inconsistent with legitimate Google services that require HTTPS.

The page title returned by the server is “Google”, matching the declared brand target. VirusTotal analysis shows that two of ninety‑five scanning engines flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high likelihood of malicious intent. The domain appears on a single security blocklist and has been taken offline, with the takedown confirmed by PhishDestroy. Current status is offline, so active probing is not possible, but historical evidence suggests the site was used for credential harvesting or similar fraudulent activity.

Uncertainty remains regarding the specific phishing kit or payload because no further content analysis is available. Defenders should continue to block the domain at DNS and network layers, monitor for any resurgence of the same hostnames or IP address, and update detection signatures to include the observed nameserver pair and the lack of TLS. Incident response teams should also verify that any user‑submitted credentials associated with the domain are compromised and advise affected users to reset passwords for Google accounts.