bluefin[.]airdrpsalert[.]sbs

Analysis of the domain bluefin.airdrpsalert.sbs (registered on 22 Oct 2025 through Dynadoc LLC) shows it was used for a Google brand impersonation campaign. DNS queries resolve the hostname to 142.250.185.100, an address owned by AS15169 Google LLC in the United States, indicating the adversary deliberately leveraged a legitimate Google IP space to increase credibility. The domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the use of a CDN or DNS‑obfuscation service. No TLS certificate was observed, meaning the site was reachable only over plain HTTP.

The page title returned “Google”, matching the declared target brand. VirusTotal scans recorded 12 positive detections out of 95 security vendors, and the domain appears on a single external blocklist, confirming that multiple security products have flagged it as malicious. Reputation services rate the domain extremely poorly: Scamadviser assigns a trust score of 1 / 100 and Gridinsoft a score of 0 / 100. PhishDestroy has already taken the domain offline, and the current status is listed as offline.

Because the infrastructure reuses a legitimate Google IP, automated defenses that rely solely on IP reputation may miss the activity, while static URL or host‑based blocklists will capture it. Defenders should add the fully qualified domain name to URL filtering policies, monitor for HTTP requests to the domain, and consider the associated Cloudflare nameservers as potential indicators of compromise. Continued observation of the registrar Dynadot and any future re‑registration attempts is recommended, as the threat actor may recycle the same naming pattern. At present, no further details such as payload, credential‑harvesting pages, or additional infrastructure have been disclosed.