bluefin[.]airsdropsalerts[.]sbs

Analysis of the domain bluefin.airsdropsalerts.sbs indicates a brand impersonation campaign targeting Google, operational as of November 2025. The domain was registered through Dynadot LLC and employs Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting infrastructure. It resolves to the IP address 142.250.186.100, geolocated in Germany under AS15169, which is assigned to Google LLC. This IP association may represent either misdirection or abuse of Google’s infrastructure, though no direct evidence confirms the latter. The domain lacks an SSL certificate, increasing susceptibility to interception and reducing user trust.

The page title 'Google' explicitly suggests an attempt to mimic Google’s branding, though no further content analysis has been conducted to verify the extent of the impersonation. Detection metrics reveal limited but notable coverage: Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist. VirusTotal reports 12 detections from 95 security vendors, indicating moderate consensus on its malicious nature. The domain has since been taken offline, though its prior resolution to a Google-associated IP and use of Cloudflare nameservers may aid in identifying related infrastructure.

Defenders should monitor for domains registered via Dynadot with similar naming conventions (e.g., 'airsdropsalerts') or those leveraging Cloudflare nameservers for brand impersonation. The absence of SSL and the use of a well-known registrar warrant heightened scrutiny for domains exhibiting these characteristics. While the exact scam mechanics remain unconfirmed, the combination of Google branding, Cloudflare obfuscation, and low detection coverage suggests a targeted effort to evade initial security checks.