nearcashback[.]com

This domain is flagged as a credential harvesting phishing site targeting users through deceptive financial incentive schemes. Analysis indicates an elevated risk level due to its association with known phishing infrastructure and detection by security vendors. The domain is currently offline, displaying a 'Server Not Found' error, but prior activity suggests malicious intent. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an anomalous creation date that may indicate domain spoofing or typosquatting. It resolves to IP address 216.198.79.1 and employs a Let's Encrypt SSL certificate, a common tactic to appear legitimate. The domain is detected by 2 out of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and OISD. Additional technical indicators include the use of Vercel hosting and HTTP Strict Transport Security (HSTS), which may be leveraged to enhance perceived authenticity. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. Mitigation steps for organizations and users include blocking the domain and its associated IP (216.198.79.1) at the network perimeter. Security teams should update endpoint protection rules to flag or quarantine any attempts to access nearcashback.com. Given the domain's use of HSTS, users should be educated on verifying SSL certificates and scrutinizing domain names for typos or inconsistencies, particularly in financial or cashback-themed communications. Monitoring for similar domains registered through NiceNIC or resolving to the same IP range is recommended to preemptively disrupt related phishing campaigns.