app-bluefin[.]xyz

The domain app-bluefin.xyz is currently active and has been classified as a high-risk generic phishing site as of 12 July 2026. VirusTotal reports that six out of ninety-five scanned security vendors flagged the domain, indicating moderate detection across the ecosystem. The site returns an HTTP 403 status code, which suggests that direct content retrieval is being blocked or restricted.

Infrastructure analysis shows the domain resolves to the IP address 104.21.28.52, hosted within Cloudflare’s network in California, United States. The authoritative nameservers are duke.ns.cloudflare.com and olivia.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. The TLS certificate is issued by Google Trust Services under the WE1 certificate authority, confirming the use of a valid, publicly trusted certificate chain.

Registrant information reveals that the domain was registered on 14 April 2026 through Dynadot LLC. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on three public security blocklists. AlienVault OTX includes the domain in one threat‑intelligence pulse, and it is also listed by PhishDestroy, MetaMask, and SEAL as a blocked indicator. These signals collectively reinforce the malicious classification despite the limited public content.

Given the observable indicators, defenders should block DNS resolution for app-bluefin.xyz, enforce TLS inspection to capture any encrypted traffic, and add the IP 104.21.28.52 to network-level deny lists. Continuous monitoring of the associated Cloudflare nameservers is advised, as the infrastructure could be repurposed for additional malicious payloads. Organizations should also incorporate the domain’s hash into endpoint detection rules to improve early warning capabilities.