bluefin[.]airsdropsalerts[.]lol

The domain bluefin.airsdropsalerts.lol was registered through Dynadot LLC and first observed on November 07 2025. The site’s only visible indicator is a page title of "Google", which aligns with the declared brand‑impersonation target of Google. No SSL certificate is presented; the domain resolves over HTTP to the IP address 142.250.185.196, which belongs to AS15169 Google LLC and is located in the United States. The infrastructure uses Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common choice for fast‑flux and abuse‑hiding techniques.

Gridinsoft assigns a trust score of 0 / 100, indicating the highest confidence of malicious intent. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows that 10 of 93 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity. The current operational status is offline, suggesting the hosting has been taken down or the site is no longer serving content.

While the IP belongs to Google’s network, the lack of HTTPS, the false page title, and the detection history imply that the domain was used to deceive users into believing they were accessing a legitimate Google service. Defenders should block the domain at DNS resolvers, add the associated IP to threat‑intel feeds, and monitor for any re‑use of the same name servers or similar sub‑domains. Continuous re‑scanning of the domain after any re‑appearance is recommended to capture changes in detection rates or new payloads.