bluefin[.]airdropsalert[.]live

Analysis of bluefin.airdropsalert.live indicates that the domain was provisioned through Cloudflare, Inc. and presently resolves to the IPv6 address 2a00:1450:4001:80f::2004, which belongs to AS15169 owned by Google LLC and is geolocated in Germany. The hosting IP is identical to infrastructure used by legitimate Google services, a tactic often employed to lend credibility to malicious pages. The site returns HTTP status code 200 and presents a page title of "Google", yet no TLS certificate is presented, leaving the connection unencrypted. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy.

Google Safe Browsing classifies the site as a social‑engineering threat, and three of ninety‑five VirusTotal scanners have flagged the domain, confirming a modest detection rate. The domain’s branding is directed at Gmail users, as indicated by the "Impersonates: gmail" tag and the "Fake Airdrop" scam type, suggesting an attempt to lure victims with a counterfeit cryptocurrency airdrop narrative that pretends to be associated with Google accounts. Nameserver information could not be retrieved, limiting visibility into the DNS configuration. The domain is currently offline, which may indicate a short‑lived campaign or takedown.

Uncertainty remains regarding the exact content served before the takedown, as no visual or HTML analysis is available. Defenders should continue to block the domain at perimeter defenses, monitor for any re‑registration attempts, and consider adding the IPv6 address to threat‑intel feeds, given its association with malicious activity despite being owned by a reputable ASN. Ongoing observation of Cloudflare‑registered domains targeting Gmail users is recommended to detect similar fast‑flux or disposable‑site campaigns.