midnight-td[.]com

midnight-td.com has been identified as an active credential theft scam targeting unsuspecting users. This domain engages in unauthorized attempts to steal sensitive login information, putting user credentials at significant risk. There is no indication of brand impersonation associated with this domain, but its malicious intent is clear based on its behavior and detection status.

Detailed analysis reveals that midnight-td.com was registered through HOSTINGER operations, UAB, on February 3, 2026. The domain resolves to the IP address 216.198.79.65 and holds an SSL certificate issued by Let's Encrypt, which may lend a false sense of legitimacy to victims. Importantly, this domain is flagged by 3 out of 95 security vendors on VirusTotal, reinforcing its malicious classification. Additionally, midnight-td.com appears on 2 separate security blocklists and is actively blocked by security tools such as MetaMask and SEAL, further confirming the elevated risk it poses.

Given its current active status and the elevated threat level, users are strongly advised to refrain from interacting with midnight-td.com or providing any personal or account information. Organizations should consider blocking this domain at network levels and educating users on recognizing credential theft schemes. Continuous monitoring for associated domains and related threat indicators is recommended to prevent compromise. Taking proactive steps will help mitigate exposure to this credential theft scam and enhance overall cybersecurity posture.