nearintentsinstaller[.]xyz

This domain, nearintentsinstaller.xyz, was identified as a phishing site masquerading as a legitimate NEAR Protocol desktop extension installer for Windows. The site targeted users seeking to download cryptocurrency wallet software, likely delivering malware or credential-harvesting payloads under the guise of a trusted blockchain tool. Analysis indicates the page was designed to exploit user trust in the NEAR ecosystem, potentially leading to unauthorized access to digital assets or system compromise. Infrastructure analysis reveals the domain was registered on May 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an uncommon future-dated creation that suggests fraudulent intent. It resolved to IP address 64.29.17.65 and was flagged by 4 out of 95 security vendors on VirusTotal, including detection for generic phishing activity. The site employed Vercel hosting and enforced HSTS, a technical measure often used to lend false legitimacy. It appeared on one security blocklist and held a Gridinsoft trust score of 0 out of 100, confirming its malicious classification. Users who visited nearintentsinstaller.xyz or downloaded files from the site should immediately disconnect the affected device from networks. Scan the system using up-to-date antivirus software to detect and remove any installed malware. Reset credentials for cryptocurrency wallets, email accounts, and any other sensitive services accessed from the compromised device. Monitor financial and blockchain transactions for unauthorized activity. Report the incident to relevant security teams or abuse contacts, providing the domain, IP address, and any downloaded files as evidence. Avoid re-engaging with the site, as it remains a confirmed threat despite its current offline status.