bluefin[.]airsdropsalert[.]lol

The domain bluefin.airsdropsalert.lol is flagged for brand impersonation targeting Google. Infrastructure analysis shows the domain resolves to IP address 142.250.185.132, which is announced by AS15169 and belongs to Google LLC in the United States. The domain was registered through Dynadot LLC on November 5, 2025 and is currently listed on a single security blocklist. No SSL certificate is presented, and the site is reported as taken offline at the time of assessment.

The page title returned by the HTTP response is "Google," directly matching the advertised brand target. Trust metrics are extremely low, with a Gridinsoft score of 0 out of 100, and the domain is actively blocked by PhishDestroy. VirusTotal scans indicate that eight of ninety‑five security vendors have flagged the domain as malicious, reinforcing the suspicion of abuse. Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both operated by Cloudflare, suggesting the use of a reputable DNS provider to obscure the underlying hosting.

While the IP belongs to Google’s infrastructure, the lack of a valid TLS certificate and the offline status imply that the domain was likely used transiently to host a malicious payload or to deceive users before being withdrawn. Defenders should continue to block the domain at perimeter defenses, monitor traffic to the associated IP for any anomalous requests, and consider adding the domain to internal blacklists. Ongoing observation of the IP’s usage patterns is advised, as the same address could be leveraged for future impersonation campaigns.