midnight-7ti[.]pages[.]dev

The domain midnight-7ti.pages.dev has been confirmed as a fraudulent crypto redemption portal designed to execute asset theft through deceptive smart contract interactions. Analysis indicates this is a crypto drainer phishing site, specifically impersonating the GlacierDrop platform to lure victims into connecting wallets under false pretenses of token redemption or airdrop claims. The site is currently offline, though prior infrastructure remains documented for forensic purposes. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain is flagged by 9 of 95 security vendors on VirusTotal, including detection by major blockchain security providers and phishing-specific detection engines. It was registered through Cloudflare, Inc. on March 23, 2026, resolving to the IP address 188.114.96.3. The domain appears on three distinct security blocklists and holds a Gridinsoft trust score of 0 out of 100. The SSL certificate is issued by Let's Encrypt, and the site employed HTTP/3, HSTS, and Cloudflare hosting, which are commonly observed in both legitimate and malicious infrastructure. The page title, GlacierDrop - Redeem NIGHT, directly references the targeted brand and a fabricated redemption process, a hallmark of crypto drainer operations. Current status indicates the domain has been taken offline, reducing immediate exposure. However, the underlying threat pattern remains active, with similar domains likely to emerge. Users who interacted with this domain should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet address. Security teams are advised to monitor for domains mimicking GlacierDrop or other yield-generating platforms, particularly those using Cloudflare Pages infrastructure with Let's Encrypt certificates. Blocklist integration for this domain and its associated IP is recommended for all endpoint and network security controls. Historical forensic data, including the domain creation date and registrar details, should be preserved for incident response and threat intelligence correlation.