blur-nft[.]xyz

The domain blur-nft.xyz was registered on 19 May 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently active. Its authoritative name servers are miles.ns.cloudflare.com and sureena.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. DNS resolution points to the IPv4 address 45.151.106.184, which is the sole host observed for this domain. The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy feed, suggesting that at least one security vendor has observed malicious activity associated with it. VirusTotal records show that the domain has been scanned by 95 AV engines, yet none have raised a detection at the time of analysis. The absence of a detection does not constitute evidence of benign behavior; it merely reflects the current coverage gap. No additional telemetry such as SSL certificate details, HTTP response codes, page title, or content signatures has been disclosed, so the surface‑web characteristics remain unknown. The threat classification attached to this indicator is “crypto drainer,” implying that the domain is likely being leveraged to solicit cryptocurrency transfers or to exfiltrate crypto assets from victims. Given the recent registration date, the use of a reputable DNS provider, and the presence on a known blocklist, the infrastructure appears to have been provisioned quickly for a targeted campaign. Defenders should add blur-nft.xyz to deny‑list rules at the DNS and proxy layers, monitor outbound connections to 45.151.106.184, and consider sinkholing the IP address if permitted by policy. Continuous re‑scanning with multi‑engine services is recommended to detect any future payloads or changes in host behavior. Correlation with internal logs for any attempted connections to the domain or IP will help identify compromised endpoints.