bluwhale[.]live

This domain is flagged as a credential harvesting phishing site designed to deceive users into entering sensitive login information. Analysis indicates the site mimics legitimate authentication portals, likely targeting users of popular online services or financial platforms. The primary threat involves the unauthorized collection of usernames, passwords, and potentially multi-factor authentication codes, which can lead to account takeovers, identity theft, or financial fraud. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is detected by 1 out of 95 security vendors on VirusTotal, appears on 4 distinct security blocklists (Codeesura, Polkadot, PhishDestroy, Enkrypt), and holds a Gridinsoft trust score of 0/100. The site is hosted behind Cloudflare, utilizing HTTP/3 and resolving to the IPv6 address 2606:4700:3031::6815:1964. The SSL certificate is issued by Google Trust Services, a common tactic to appear legitimate, while the registrar is Cloudflare, Inc. The page title 'Just a moment...' suggests the use of anti-bot mechanisms to evade detection and analysis. If you visited bluwhale.live or entered any credentials, immediate action is required to mitigate risk. First, revoke access to any accounts that may have been exposed by changing passwords and enabling multi-factor authentication where available. Monitor these accounts for unauthorized transactions or suspicious activity. Next, scan your device for malware using updated security tools to ensure no additional payloads were delivered. Finally, report the incident to relevant authorities or your organization's security team to assist in tracking and mitigating the threat. Avoid re-engaging with the domain, as it has been confirmed offline and taken down, but similar threats may emerge under different addresses.