bluefin[.]app-airdropalert[.]lat

On 23 July 2026, threat‑intel analysts examined the domain bluefin.app-airdropalert.lat, which was registered on 10 November 2025 through Dynadot LLC. The domain resolves to the IP address 142.250.185.132, an address owned by AS15169 Google LLC and located in the United States. Despite the IP belonging to Google’s network, the domain is unauthenticated: it lacks an SSL/TLS certificate and serves only an HTTP response that returns the page title "Google". The site is classified as a crypto‑scam and is explicitly noted to impersonate Google. Infrastructure indicators include Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS services for concealment.

Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. The domain has been blocked by the PhishDestroy service and appears on one external security blocklist. VirusTotal analysis shows that 13 of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment. Current operational status is offline, and no further content has been captured.

Uncertainties remain regarding the exact payload or phishing kit used, as no page content or HTTP payload has been archived. Defenders should proactively block the domain and its associated IP at network perimeters, add the host to internal and external blocklists, and monitor for any new sub‑domains or similar Cloudflare name‑server configurations that reference the same IP range. Continuous re‑scanning with multi‑vendor services is advised to capture any future changes in the domain’s behavior.