blur[.]gay

This domain, blur.gay, is flagged as a high-risk brand impersonation site, specifically targeting the brand 'blur'. The domain was registered on January 16, 2025, through NameCheap, Inc., and currently resolves to the IP address 52.85.132.77, which is located in the United States and associated with Amazon.com, Inc. (ASN16509). The site has been identified on three security blocklists, including PhishDestroy and ScamSniffer, which suggests it has been involved in malicious activities. The page title 'it's blur' is consistent with efforts to impersonate the legitimate 'blur' brand, potentially leading users to believe they are interacting with an official site. Analysis of the domain's infrastructure reveals the use of Amazon Web Services, Amazon S3, and Amazon CloudFront, which are common in hosting phishing sites due to their reliability and global reach. The Gridinsoft trust score for this domain is 0/100, indicating a very low level of trust and a high likelihood of being associated with malicious activities. While the site has not been flagged by VirusTotal, this does not provide a definitive safety assessment as the service may not have analyzed the site yet. Defenders should treat this domain with caution and consider implementing additional security measures such as DNS blacklisting, email filtering, and user education to prevent accidental access. The exact content of the site has not been analyzed, but the impersonation of the 'blur' brand and the presence on multiple blocklists strongly suggest that it is being used for a brand impersonation scam. Regular monitoring and updating of security policies are recommended to stay ahead of any evolving tactics used by the threat actors.