midnight-airdrop[.]org

This domain, midnight-airdrop.org, is flagged as a high-risk brand impersonation threat targeting cryptocurrency users through airdrop scams. Analysis indicates the infrastructure was designed to mimic legitimate token distribution events, likely aiming to deceive victims into connecting wallets or disclosing private keys. No specific drainer kit signatures were identified, but the domain aligns with known patterns of fraudulent airdrop promotions, including the use of urgency-driven messaging and fake reward claims to exploit user trust.

Infrastructure analysis reveals the domain was registered on January 13, 2026, through Dynadot Inc, a registrar frequently associated with transient malicious domains. It resolves to the IP address 172.67.134.49, a Cloudflare proxy endpoint commonly used to obscure hosting origins. Detection metrics show 15 out of 95 security vendors flagged the domain on VirusTotal, while it appears on three independent blocklists, including MetaMask’s threat intelligence feed. The domain employed Google Web Server technology, HTTP/3, and HSTS, suggesting an attempt to appear technically legitimate despite its fraudulent intent. No Google Safe Browsing (GSB) listing was observed at the time of assessment, though this may reflect a lag in propagation rather than benign status.

As of the latest verification, midnight-airdrop.org has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk persists due to the domain’s recent creation and the potential for re-registration or migration to alternative infrastructure. Users who interacted with the domain are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify token contracts through official project channels. Organizations should update blocklists to include the domain and associated IP, while security teams should correlate this indicator with other airdrop scam campaigns to identify broader threat clusters.