bluefin[.]airdrpalert[.]click

The domain bluefin.airdrpalert.click was registered through Dynadot LLC on October 30, 2025 and is presently taken offline. Technical inspection shows it resolved to the IP address 142.250.186.164, which is announced by AS15169 and is owned by Google LLC in the United States. The hosting choice suggests an attempt to gain credibility by leveraging a legitimate cloud provider, yet the site lacked an SSL certificate, a common omission in quickly deployed phishing infrastructure. The page title returned by the HTTP response was simply "Google," matching the declared brand target of Google and confirming the brand‑impersonation intent.

Trust metrics are unfavorable: Gridinsoft assigned a score of 0 out of 100, indicating a high likelihood of malicious use. The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scans recorded two detections out of ninety‑five participating AV engines, reinforcing the suspicion of abuse. Nameserver configuration uses brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑operated, a pattern frequently observed in malicious domains that exploit fast‑flux or CDN services to obscure origin.

The risk rating is elevated, reflecting the combination of brand impersonation, low trust score, and partial detection by security vendors. Defenders should ensure the domain is added to local and network‑level blocklists, monitor the associated IP range for any re‑use, and watch for future registrations that reuse the same nameservers or similar naming patterns. Continuous re‑assessment is advised, as the offline status may change if the actors reactivate the site or shift to a new host.