midnightportal[.]net

On 25 July 2026, analysis of the domain midnightportal.net indicates that the site was used for brand impersonation targeting the Across brand. The domain was registered on 21 December 2025 through Web4Africa Inc. and resolves to the IP address 102.209.117.148, which is located in South Africa and belongs to AS329184 Host Africa (Pty) Ltd. No TLS certificate was observed, meaning HTTPS connections are not available. The HTTP response presented the page title “Midnight TGE | Home,” but the underlying page content has not been publicly captured, leaving the exact visual or functional characteristics unknown. Infrastructure data shows that the domain is serviced by four nameservers—ns1.host-ww.net, ns2.host-ww.net, ns3.host-ww.net, and ns4.host-ww.net—consistent with the registrar’s hosting configuration.

Reputation checks reveal a Gridinsoft trust score of 0 / 100 and a detection count of 5 out of 93 security vendors on VirusTotal, indicating that multiple scanners have flagged the domain as malicious. The domain also appears on four security blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing its classification as hostile. The site is currently taken offline, which may be the result of takedown actions or the operator’s removal of the content.

Given the combination of a low trust score, multiple blocklist listings, and vendor detections, the domain should be considered high‑risk for brand‑impersonation attacks. Defensive actions recommended for security teams include adding midnightportal.net to URL filtering policies, monitoring for any resurgence of the domain or related infrastructure, and ensuring that endpoint protection solutions are updated to reflect the observed detections. Continuous observation of the hosting ASN and associated IP range is advised, as adversaries often reuse infrastructure for subsequent campaigns.