limited-near[.]org

On July 24, 2026, limited-near.org was observed to be hosted on Cloudflare infrastructure (IP 172.67.192.24, AS13335, United States) and registered through NameSilo, LLC on February 21, 2026. The domain resolves to Cloudflare's edge network and uses the nameservers algin.ns.cloudflare.com and daphne.ns.cloudflare.com. TLS is presented with a certificate labeled WE1, which does not correspond to a recognized certificate authority and is typical of fast‑flux or malicious deployments. The site’s HTTP response is currently offline, indicating the operator has taken the site down, but historical data shows the page title was “$NEAR AIRDROP NEAR”, which aligns with a wallet/seed phishing campaign that leverages a fabricated Near blockchain airdrop.

Intelligence links the activity to the publicly known “Airdrop Scam” phishing kit, a modular framework commonly used to harvest cryptocurrency wallet seeds. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal recorded 11 of 93 scanning engines flagging the domain as malicious, and the domain appears on a single security blocklist. PhishDestroy has also added it to its blocklist, confirming community detection.

The domain is categorized as a wallet/seed phishing impersonation targeting “across” brands, suggesting the operator may reuse the same infrastructure for multiple cryptocurrency‑related campaigns. Defenders should block DNS resolution to limited-near.org at the network perimeter, add the IP address 172.67.192.24 to deny lists where appropriate, and monitor for any resurgence of the same nameserver pair or TLS fingerprint. Because the site is currently offline, continuous monitoring of the registrar’s WHOIS record for re‑registration attempts and of Cloudflare edge IP ranges for similar patterns is advised.