docs.bluefin.moscow

The domain docs.bluefin.moscow is currently active and resolves to the IPv4 address 95.129.236.70. The web server returns HTTP 200 responses, indicating that content is being served. DNS is delegated to ns1.ddos-guard.net and ns2.ddos-guard.net, both owned by the DDOS‑Guard service provider. The site is built on the 1C‑Bitrix content management system and uses PHP, Swiper, Select2, jQuery, and the DDoS‑Guard protection kit, confirming the presence of typical web‑application stacks.

The SSL certificate is issued by Let’s Encrypt (R12), which provides only transport encryption and does not attest to the legitimacy of the host. Reputation checks show the domain appears on one security blocklist and has a Gridinsoft trust score of 0 out of 100, indicating a high likelihood of malicious use. PhishDestroy has already blocked the domain, and VirusTotal reports that 4 of 95 scanning engines flag the domain as malicious. The hosting IP belongs to AS57724, registered to DDOS‑GUARD LTD in Russia, and the registrar is Regional Network Information Center, JSC dba RU‑CENTER.

The domain was created on 10 July 2018, suggesting a long‑standing infrastructure that has been repurposed for phishing. While the specific phishing landing page content has not been publicly disclosed, the combination of a low trust score, blocklist presence, multiple vendor detections, and the use of a generic phishing classification points to a high‑risk credential‑stealing operation. Defenders should add docs.bluefin.moscow to URL filtering and endpoint blocklists, monitor outbound connections to 95.129.236.70, and enforce TLS inspection to capture any credential submission. Continuous re‑evaluation is advised, as the threat actor may modify the site or shift hosting.