blurapp[.]net

Analysis indicates the domain blurapp.net is actively engaged in brand impersonation targeting Apple, as evidenced by its page title 'Blur App APK - Download v4.3.1 [Photo Editor] for Android,' which does not align with Apple's official services but mimics app distribution patterns. The domain was registered on January 27, 2025, through NameCheap, Inc., and currently resolves to IP address 172.67.146.52. Infrastructure analysis reveals the use of Cloudflare, jsDelivr, and HTTP/3, which are common in both legitimate and malicious deployments but often leveraged by threat actors to obscure origin and evade detection. The domain appears on four security blocklists and is flagged by multiple threat intelligence sources, including 23 pulses in AlienVault OTX. It is actively blocked by at least four security tools, though no detections were recorded in a recent scan by 95 vendors. The SSL certificate is issued by Google Trust Services, providing encrypted connections but not validating the site's legitimacy. Scamadviser and Gridinsoft assign trust scores of 16/100 and 0/100, respectively, further indicating high risk. While the domain remains operational as of July 12, 2026, the absence of detections in recent scans does not confirm safety. Defenders should treat this domain as malicious based on confirmed brand impersonation, blocklist presence, and low trust scores. Network-level blocking or monitoring of connections to 172.67.146.52 is recommended. Further analysis of the site's content and payloads is advised to determine the exact nature of the threat, though no specific scam category or malicious kit has been confirmed at this time.