iy5ts[.]it

Analysis of the domain iy5ts.it indicates it is a brand impersonation scam targeting Blur, a known platform, with elevated risk classification. The domain was registered on December 15, 2025, through Dynadot LLC and is currently offline. Infrastructure analysis reveals it resolved to the IP address 172.67.196.83, hosted on Cloudflare's network (AS13335) in the United States. The domain employed Cloudflare nameservers (aria.ns.cloudflare.com and arturo.ns.cloudflare.com) and technologies including Vue.js, HSTS, and HTTP/3, though no SSL certificate was detected. Detection data shows the domain was flagged by 16 of 93 security vendors on VirusTotal, appearing on two security blocklists.

It was also identified in one AlienVault OTX threat intelligence pulse. Two security services, PhishDestroy and ScamSniffer, explicitly blocked this domain. Gridinsoft assigned it a trust score of 0/100, reinforcing its malicious classification. While the domain is now offline, its prior activity and detection metrics confirm its use in brand impersonation.

Defenders should treat this domain as confirmed malicious. Blocklist enforcement at the network and endpoint levels is recommended, along with monitoring for any resurgence or related domains using similar infrastructure. The absence of an SSL certificate and reliance on Cloudflare may aid in identifying associated threats. No specific details about the page content or user interaction mechanisms are available, but the scam type is explicitly categorized as brand impersonation targeting Blur.