grade[.]bluefina[.]com

grade.bluefina.com was observed serving an HTTP 200 response with the page title “Comming Soon - Bluefiná”. The site is currently taken offline, and the domain is listed as blocked by PhishDestroy and appears on a single security blocklist. Registration data shows the domain was created on 28 October 2013 through GoDaddy.com, LLC, and the authoritative nameservers are marjory.ns.cloudflare.com and rodney.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. DNS resolution points to IP 104.26.6.186, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States.

The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint despite the domain’s malicious classification. A scan on VirusTotal recorded a single positive detection out of 95 security‑vendor engines, and the Gridinsoft trust score is 0 / 100, reflecting an extremely low reputation. The limited detection footprint suggests that the infrastructure is relatively small or newly repurposed.

Because the content of the landing page has not been fully analysed beyond the title, the exact phishing payload or credential‑collection mechanism remains unknown. Defenders should continue to block the domain at network perimeter, monitor any DNS queries for the associated Cloudflare IP ranges, and update endpoint protection with the observed VirusTotal indicator. Additional investigation of the hosting environment and any related sub‑domains is advised to determine whether the infrastructure supports a broader campaign.