themasterscraft[.]com

The domain themasterscraft.com has been identified as a brand impersonation threat specifically targeting the NEAR brand. Classified at an elevated risk level, this domain is currently offline. The threat type indicates that the domain was designed to deceive users into believing they were interacting with legitimate NEAR services, potentially to steal sensitive information.

Registered on January 6, 2003, through GoDaddy.com, LLC, themasterscraft.com resolves to IP address 199.16.173.127. The page title displayed was "Home - RW Supply + Design," which bears no relation to NEAR, suggesting an attempt to blend in. The domain is flagged by 12 out of 95 security vendors on VirusTotal, indicating broad recognition as malicious. It also appears on two security blocklists and is recorded in six AlienVault OTX threat intelligence pulses. The SSL certificate was issued by Let's Encrypt, which is a free certificate provider often abused by threat actors.

Currently, the domain has been taken offline, mitigating immediate risk. However, users should remain vigilant. PhishDestroy recommends that anyone who may have visited the domain or provided information should change passwords and monitor accounts for suspicious activity. Organizations should block this domain and similar variations to prevent future attacks. PhishDestroy continues to monitor and analyze such threats to protect users from brand impersonation and other cyber threats.