bluefin[.]app-airdropalert[.]cfd

The domain bluefin.app-airdropalert.cfd has been identified as a brand impersonation scam targeting Gmail. It is currently offline and poses an elevated risk level. Analysis confirms that the domain impersonates Google, potentially misleading users into divulging sensitive information.

This domain is flagged by 11 of 95 security vendors on VirusTotal, indicating a moderate level of suspicion within the security community. The domain was registered through Dynadot LLC and does not have an SSL certificate, which is a common indicator of phishing sites. It resolves to the IP address 142.251.140.164, which is located in the United States and is part of the AS15169 Google LLC network. The domain was created on November 10, 2025, and appears on one security blocklist. The page title found is 'Google', further reinforcing the brand impersonation threat.

Given the current offline status of the domain, it is recommended that users remain vigilant and avoid interacting with any related links or emails. Security teams should monitor the domain for any signs of reactivation and consider adding it to internal blocklists. Additionally, users should be educated on the importance of verifying the legitimacy of domain names and URLs before entering any sensitive information.