near-gift[.]com

The domain near-gift.com was registered on September 29, 2025 through the REGRU-RU registrar and is hosted on the IP address 185.254.96.30, which belongs to AS58212 (dataforest GmbH) in Germany. DNS resolution uses the a.dnspod.com, b.dnspod.com, and c.dnspod.com nameservers, indicating reliance on the DNSPod service. No TLS certificate is presented, so connections are unencrypted. The site’s HTTP response currently indicates an offline status, and it has been taken down by the hosting provider or takedown request, as reflected in the “Current status: taken offline” note.

The page title returned when the site was live reads “NEAR | Blockchains, Abstracted,” but no further content analysis is available. The domain appears on a single security blocklist and is explicitly flagged by PhishDestroy as a malicious resource. VirusTotal scans show that seven of ninety‑five security vendors detected the domain as malicious, reinforcing the suspicion. Gridinsoft’s trust score of 0 out of 100 further confirms a lack of credibility.

The domain is classified under the scam type “Wallet/Seed Phishing” and is listed as impersonating the brand “across,” suggesting that it may have been used to lure victims into divulging cryptocurrency wallet credentials or seed phrases. Defenders should immediately block near-gift.com at network perimeter and DNS layers, monitor for any related C2 traffic from the associated IP range, and consider adding the domain to internal threat intelligence feeds. Continuous observation of the hosting ASN and any future re‑registration attempts is advised, as threat actors often reuse infrastructure. The limited public evidence—absence of SSL, offline status, and minimal blocklist presence—means that the full scope of the campaign cannot be fully quantified, but the available indicators warrant elevated mitigation measures.