nearmobile-airdrop[.]xyz

This report details the threat posed by the domain nearmobile-airdrop.xyz. The site, with a page title of "NPro token by NEAR Mobile," impersonates the Apple brand and is classified as a tech_support scam. The primary threat is that it attempts to deceive users into believing it offers legitimate token-related services from NEAR Mobile, likely to extract sensitive information or payment under the guise of technical support.

Technical analysis reveals the domain was created on 2026-02-21 and is hosted on IP address 188.114.97.3, located in the United States and assigned to AS13335 Cloudflare, Inc. It has an SSL certificate type WE1. VirusTotal data shows 5 detections out of 95 vendors, with specific flags from alphaMountain.ai, CyRadar, Forcepoint ThreatSeeker, Fortinet, and G-Data. The domain is listed on 2 blocklists and has a GridinSoft trust score of 0 out of 100.

The site is currently down or offline. The DOM risk score is 70, indicating a high risk level. Based on the provided data, this domain poses a significant security threat due to its impersonation of a reputable brand and its classification as a tech support scam.