airdrop[.]midnight-network[.]lat

This domain, airdrop.midnight-network.lat, is currently flagged as an active crypto drainer operation targeting cryptocurrency users. Analysis indicates the site presents itself under the page title 'Midnight | NIGHT token,' suggesting a focus on the Midnight blockchain or its associated NIGHT token. The domain was registered on March 11, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, and remains operational as of July 12, 2026, with an HTTP 200 status code confirming its accessibility. Infrastructure analysis reveals the domain resolves to the IP address 76.76.21.21, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain employs Cloudflare nameservers (amos.ns.cloudflare.com and maya.ns.cloudflare.com) and uses a Let's Encrypt SSL certificate (E7), which is common among both legitimate and malicious sites. Security vendors have detected this domain with low consensus—only 2 out of 95 vendors on VirusTotal flag it as malicious—though it appears on one security blocklist and is specifically blocked by PhishDestroy. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. The exact mechanics of the crypto drainer remain unconfirmed, as the page content has not been fully analyzed. However, the combination of a cryptocurrency-themed page title, recent registration, and low detection rates among security vendors suggests an attempt to evade automated defenses. Defenders should treat this domain as a high-risk asset, particularly in environments where cryptocurrency transactions or token interactions occur. Network-level blocking of the domain and its resolved IP address is recommended, alongside monitoring for connections to 76.76.21.21 or related Cloudflare-hosted endpoints. Given the domain's recent creation and active status, further scrutiny of associated infrastructure, such as co-hosted domains or linked wallet addresses, may reveal additional threat vectors.