4887[.]bluefin[.]pr[.]app[.]bluefin[.]foundation

The domain 4887.bluefin.pr.app.bluefin.foundation is actively hosted on Cloudflare infrastructure, resolving to IP address 104.21.77.229. Its authoritative name servers are jocelyn.ns.cloudflare.com and trace.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. Registration was performed through Namecheap Inc on January 18, 2023, and the registration remains active as of the report date, August 07, 2026.

The domain has been listed on three external security blocklists and is flagged by the PhishDestroy, MetaMask, and SEAL blocklist providers, reflecting consensus among multiple threat‑intel sources that the domain is associated with malicious activity. VirusTotal reports indicate that the domain was scanned by 91 anti‑malware vendors, none of which generated a detection; this lack of detections is not evidence of benign intent and should be interpreted as a data point rather than a clearance. No public information about the site’s SSL certificate, HTTP status code, page title, or content has been disclosed, leaving the exact phishing payload or impersonated brand unverified.

Consequently, defenders should treat the domain as high‑risk and incorporate it into URL filtering policies, blocklist it at perimeter defenses, and monitor outbound connections to the associated Cloudflare IP. Continuous DNS observation is recommended to detect any future changes in the domain’s resolution or hosting configuration. Given the active registration and presence on multiple blocklists, proactive containment—such as network‑level denial and user‑education alerts—will reduce exposure while further investigation of the site’s content is pursued.