bluefln[.]top

The domain bluefln.top was observed hosting a phishing page that advertises a purported “Bluefin $BLUE Airdrop”. The page title retrieved from the site is exactly “Bluefin $BLUE Airdrop”, indicating the use of a crypto‑airdrop theme to lure victims. The site resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated to the United States. The domain is served from Cloudflare’s infrastructure, as shown by the authoritative nameservers camilo.ns.cloudflare.com and serena.ns.cloudflare.com. No TLS certificate was presented, meaning the site accepted only unencrypted HTTP connections. The registrar listed for bluefln.top is 耐思尼克国际集团有限公司, and the domain was created on 23 December 2025.

Google Safe Browsing categorised the URL as “social engineering”, consistent with the phishing intent. VirusTotal scans returned a detection rate of 19 out of 93 security vendors, confirming that a significant portion of antivirus and URL‑filtering products consider the domain malicious. The Gridinsoft trust score is 0 out of 100, and the domain appears on at least one public security blocklist. It has also been blocked by the PhishDestroy sinkhole, indicating that defensive feeds are already mitigating traffic to the host. The threat actor appears to have leveraged an “Airdrop Scam” phishing kit, a known template that promises free cryptocurrency tokens in exchange for user credentials or wallet access.

The high risk rating assigned to the domain reflects the combination of its recent creation, lack of encryption, low trust scores, and the presence of a crypto‑related scam. Because the site is currently offline, active exploitation may have ceased, but the infrastructure—particularly the Cloudflare IP address—could be reused for future campaigns. Defenders should continue to block the IP 188.114.96.3 and the domain bluefln.top at network perimeter and DNS layers.