bluefin[.]airdrpsalert[.]click

The domain bluefin.airdrpsalert.click is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into disclosing sensitive information, such as login credentials. No crypto drainer kit was identified in this campaign. As of the latest verification, bluefin.airdrpsalert.click has been taken offline.

Technical analysis of bluefin.airdrpsalert.click reveals limited detection, with 2 of 95 VirusTotal security vendors flagging it as malicious, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on October 26, 2025, and resolves to the IP address 142.250.185.164, hosted on Google LLC's infrastructure in the US. It appears on one security blocklist, PhishDestroy, and lacks an SSL certificate. The observed page title is 'Google', and its nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Google Safe Browsing has not flagged the domain, and Gridinsoft assigns it a trust score of 0/100.

Users who may have interacted with bluefin.airdrpsalert.click should immediately change any passwords entered on the site, particularly for Google accounts, and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized activity and report any suspected fraud to the impersonated brand, Google. Additionally, victims can report the phishing domain to their email provider, browser vendor, or organizations like the Anti-Phishing Working Group (APWG) at reportphishing@apwg.org to aid in takedown efforts.