blurrww[.]pages[.]dev

On July 24, 2026, the domain blurrww.pages.dev was flagged as an elevated‑risk brand‑impersonation site targeting Blur. The site was created on 22 March 2026 and is registered through Cloudflare, Inc., using the nameservers gerald.ns.cloudflare.com and kate.ns.cloudflare.com. DNS resolution points to the Cloudflare edge address 188.114.97.3, which is geolocated to Canada. The TLS certificate is issued by Google Trust Services (WE1), indicating a valid HTTPS handshake despite the malicious intent. HTTP requests return a 403 status code, and the page title captured by crawlers reads 'Blockchain Integration Framework – We are help to help you resolve your crypto r…', suggesting a crypto‑related scam narrative.

Automated analysis detected a stack of front‑end libraries (Bootstrap, React, Select2, OWL Carousel, jQuery) and security‑related headers (HSTS) together with decimal.js, all typical of a modern web application but offering no evidence of legitimate functionality. VirusTotal scans reported 10 positive detections out of 94 antivirus engines, and the domain appears on a single security blocklist. Additionally, PhishDestroy has listed the domain as blocked, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. No Safe Browsing or Open Threat Exchange records were observed for this host.

The evidence confirms that the infrastructure is purpose‑built to impersonate Blur and to lure victims into cryptocurrency‑related schemes. Because the site is currently offline, immediate takedown is not possible, but defenders should continue to monitor the domain and associated IP address for re‑activation. Recommendations include adding the domain and its IP to internal blocklists, updating web‑filter rules to deny any traffic to blurrww.pages.dev, and sharing the indicators of compromise with threat‑intel communities.