zuloria[.]top

Analysis indicates that the domain zuloria.top was registered on August 12 2025 through Gname.com Pte. Ltd. The authoritative name servers are aria.ns.cloudflare.com and arturo.ns.cloudflare.com, both owned by Cloudflare. DNS resolution points to IP 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate is presented, meaning the site does not offer HTTPS encryption. The domain is currently taken offline, which may limit immediate interaction but does not remove the risk of re‑activation or reuse of the same infrastructure. Security telemetry shows the site is listed on two public blocklists, PhishDestroy and ScamSniffer, and appears in VirusTotal scans with 12 of 95 antivirus engines flagging it as malicious.

The Gridinsoft trust score of 1 out of 100 further reflects an extremely low reputation. The reported scam type is brand impersonation targeting the brand “blur”, confirming that the infrastructure was intended to masquerade as a legitimate blur service. The combination of low trust score, multiple vendor detections, and blocklist listings suggests a high confidence that the domain was used for phishing or credential‑stealing activity. Uncertainty remains regarding the exact content that was hosted, as no page title or HTTP response body has been captured, and no SSL certificate details are available beyond the absence of one.

Consequently, the specific tactics, techniques, and procedures employed by the operators cannot be fully described. Defenders should continue to block zuloria.top at DNS, proxy, and firewall layers, monitor for any resurrection of the domain or re‑use of the associated IP address, and update threat intelligence feeds with the observed indicators. Given the association with the blur brand, organizations that depend on blur services should educate users about the lack of a valid HTTPS certificate and the presence of the domain on known blocklists.