blur-world[.]xyz

This domain, blur-world.xyz, is identified as a high-risk brand_impersonation threat specifically targeting users of the financial service Revolut. Analysis confirms the domain was actively used in phishing operations, presenting an "Airdrop Claim" page title to deceive victims. The domain is currently marked as offline but remains a documented threat in security databases. Infrastructure analysis reveals the domain was flagged by 19 of 95 security vendors on VirusTotal, indicating widespread detection. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 07, 2026, and resolved to the IP address 104.21.51.115, hosted on Cloudflare's network (AS13335). The domain appears on four distinct security blocklists, including entries from PhishDestroy, MetaMask, ScamSniffer, and SEAL. Notably, no SSL certificate was associated with the domain, further reducing its legitimacy. The creation date and rapid inclusion in blocklists suggest a deliberate attempt to impersonate Revolut for fraudulent purposes. As of the latest assessment, blur-world.xyz is offline, but its historical activity and presence in threat intelligence feeds warrant continued caution. Organizations and users are advised to block the domain and its associated IP (104.21.51.115) at the network level. Security teams should monitor for related indicators, including the registrar PDR Ltd. and the absence of SSL certificates in similar domains. End-users should be educated on recognizing brand_impersonation tactics, particularly those involving fake airdrop or reward schemes. Proactive measures, such as updating endpoint protection rules and reviewing logs for connections to the IP or domain, are recommended to mitigate residual risk.