app[.]blurcards[.]com

The domain app.blurcards.com is currently active and has been identified as a brand‑impersonation site targeting the cryptocurrency platform Blur. The site presents the page title “Blur Card: Spend Crypto Everywhere,” which directly references Blur’s branding. Infrastructure analysis shows the domain is registered through GoDaddy.com, LLC and uses GoDaddy’s default nameservers ns03.domaincontrol.com and ns04.domaincontrol.com. DNS resolution points to the IP address 34.111.179.208, a Google Cloud host located in the United States. The site serves a valid TLS certificate from Let’s Encrypt (certificate identifier YE1) and returns HTTP 200 responses, indicating a functional web server. The domain is listed on a single security blocklist and is also blocked by PhishDestroy. VirusTotal reports that 2 of 91 security vendors have flagged the domain, confirming that at least a subset of scanners consider it malicious. No additional technical indicators such as malware hashes or payload descriptions are available in the current intelligence. Because the site explicitly references Blur and presents a seemingly legitimate service (“Spend Crypto Everywhere”), it is likely intended to lure Blur users into disclosing credentials or transferring funds. Defenders should add app.blurcards.com to network‑level block lists, monitor for outbound connections to the associated IP address, and educate users that any unsolicited requests to “Blur Card” services originating from this domain are fraudulent. Continuous re‑evaluation is recommended as further content analysis or additional detections become available.