bluwhales[.]xyz

Analysis of bluwhales.xyz, created on 21 October 2025 and currently taken offline, confirms it was used for a generic phishing operation. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and points to the Cloudflare‑owned address 104.21.54.228 (AS13335, United States). Both authoritative nameservers, brenna.ns.cloudflare.com and yichun.ns.cloudflare.com, resolve to Cloudflare infrastructure, a pattern frequently observed in malicious hosting due to its rapid provisioning and built‑in anonymity. The site returned an HTTP response with the title "Error" and lacked an SSL/TLS certificate, suggesting a hastily deployed or abandoned landing page.

Reputation metrics are uniformly poor: Gridinsoft assigned a trust score of 0 out of 100, Scamadviser reported 1 out of 100, and the domain appears on a single security blocklist. VirusTotal scans recorded 4 detections out of 95 participating vendors, and PhishDestroy has explicitly blocked the domain. AlienVault OTX lists the domain in one threat‑intelligence pulse, reinforcing its association with hostile activity.

Although the content of the page has not been publicly disclosed, the convergence of low trust scores, multiple vendor detections, and blocklist listings provides strong evidence of phishing intent. Defenders should immediately add bluwhales.xyz and its resolving IP address 104.21.54.228 to network deny lists, monitor for any re‑registration attempts, and continue to track related Cloudflare nameservers for future campaigns. Ongoing vigilance is advised, as the infrastructure may be repurposed for new phishing sites despite the current offline status.