events-bluefin[.]xyz

This domain is flagged as a high-risk generic phishing threat, specifically identified as a crypto scam. Registered on April 14, 2026, through Dynadot LLC, the domain remains active as of July 13, 2026, and resolves to IP 188.114.96.3, hosted on Cloudflare infrastructure (ASN associated with Cloudflare, Inc., located in Canada). The page title is 'Just a moment...', suggesting an initial redirect or access gate, and the HTTP status is 403, blocking direct content retrieval. Security analysis shows strong indicators of malicious intent: the domain appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scanning reports 8 of 94 security vendors flagging the domain, and AlienVault OTX includes it in one threat intelligence pulse. The Gridinsoft trust score is 0 out of 100, reflecting high distrust. The SSL certificate is issued by Let's Encrypt (E7), a common choice for rapid deployment. Infrastructure analysis reveals that the domain uses Cloudflare nameservers (carlos.ns.cloudflare.com and reza.ns.cloudflare.com), which may provide DDoS protection and obscure the origin server. What is uncertain is the exact phishing payload or landing page content, as the 403 status prevents full retrieval. Defenders should block the domain at network and DNS levels, add it to threat intelligence feeds, and investigate any associated IP ranges or certificates for related infrastructure. Given the active status and multiple blocklist hits, immediate containment is recommended to prevent credential or cryptocurrency theft.