midnight-airdrop[.]xyz

midnight-airdrop.xyz was observed hosting a cryptocurrency draining operation. The domain was created on 21 February 2026 and, at the time of analysis on 23 July 2026, the hosting service had taken the site offline. DNS resolution points to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The TLS certificate presented for the domain is identified as WE1, indicating a standard SSL implementation without additional validation.

The page title returned by HTTP requests is “Midnight TGE | Claim”, which aligns with the reported scam type of a crypto scam. Ten of ninety‑three VirusTotal scanners flagged the domain as malicious, and the domain appears on five independent security blocklists. Multiple threat‑intelligence feeds have already blocked the site, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura. The combination of a recent registration date, Cloudflare hosting, a valid SSL certificate, and the “Midnight TGE | Claim” title suggests the site was presenting a claim related to a token generation event, consistent with a cryptocurrency draining campaign.

Because the site is currently offline, active mitigation is limited to ensuring that any cached URLs are removed from internal blocklists and that security products continue to reference the existing detections. Defenders should update URL filtering rules to include midnight‑airdrop.xyz, monitor for any future re‑registration of the same name or similar TGE‑related keywords, and consider sharing the indicator set with upstream filtering services. Ongoing observation of the IP 188.114.97.3 is advisable, as Cloudflare often hosts multiple unrelated domains that may be repurposed for further scams.