midnight-site[.]onrender[.]com

Analysis indicates that midnight-site.onrender.com was provisioned on the Render hosting platform (ASN 397273) and resolves to IP 216.24.57.251, a server located in the United States. The site presented a HTTP 404 response at the time of investigation, and its SSL certificate was issued by Google Trust Services under the WE1 intermediate, confirming that TLS was correctly configured despite the error page. The page title returned by the server was “Midnight TGE | Home”, which does not reveal any legitimate brand and is consistent with a placeholder page often used in phishing infrastructure. VirusTotal recorded ten detections out of ninety‑five scanning engines, and the domain appears on a single external blocklist.

PhishDestroy has already taken the domain offline, and the current status is reported as “taken offline”. The hosting environment reported Cloudflare services and HTTP/3 support, suggesting that the attacker leveraged a CDN to obscure origin details. Registration was performed through Render Services Inc., and the domain’s nameserver information is missing (NS_NOT_FOUND). No additional intelligence such as Safe Browsing or OTX references was available, and the content of the site could not be captured because the server returned a 404 and the domain is now offline.

Consequently, the exact phishing payload, target brand, or credential‑harvesting mechanism remains unknown. Defenders should block the domain and its resolved IP address at perimeter and DNS layers, add the domain to internal threat‑intel feeds, and continue monitoring the ASN for any new sub‑domains that may be launched with similar techniques. Ongoing surveillance of Render‑hosted infrastructure is advised, as the provider has been used for prior malicious deployments.