bluefin[.]airdropsalert[.]bar

The domain bluefin.airdropsalert.bar has been confirmed as a high-risk phishing site specializing in brand impersonation, specifically targeting Gmail users. Analysis of the page title, which displays 'Google,' alongside the absence of an SSL certificate, indicates an attempt to deceive users into believing they are interacting with legitimate Google services. The domain is currently offline, but prior activity aligns with credential harvesting tactics commonly employed in phishing campaigns. Infrastructure analysis reveals the domain was registered through Dynadot LLC on October 20, 2025, and resolved to the IP address 172.217.18.4, geolocated in the United States under AS15169 (Google LLC). Despite the IP association with a legitimate provider, the domain itself has been flagged by 17 out of 95 security vendors on VirusTotal as malicious. Additionally, Google Safe Browsing has explicitly categorized this domain as phishing, and it appears on at least one security blocklist, further corroborating its fraudulent nature. The domain's creation date, combined with its rapid detection by security systems, suggests a short-lived but high-impact campaign. Current status indicates the domain has been taken offline, likely due to enforcement actions or detection by security mechanisms. However, the infrastructure and registration patterns observed may resurface under alternative domains. Organizations and users are advised to implement real-time domain monitoring for newly registered lookalike domains, enforce strict SSL certificate validation, and deploy endpoint protection capable of detecting brand impersonation attempts. Users should verify domain authenticity before entering credentials and report suspicious domains to relevant security teams for further investigation and mitigation.