midnight-gd[.]com

Midnight-gd.com was registered on 21 February 2026 and currently resolves to the IPv4 address 102.209.117.25, which is allocated to AS329184 Host Africa (Pty) Ltd in South Africa. The site presents a page titled "Connect" and is associated with a crypto‑scam campaign that impersonates the decentralized exchange aggregator 1inch. Infrastructure analysis shows that the domain is listed on four independent security blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—indicating that multiple threat‑intelligence operators have observed malicious activity linked to this host. VirusTotal scans have recorded detections from 15 of 93 security vendors, reinforcing the suspicion of malicious intent.

AlienVault OTX has documented the domain in a single threat‑intelligence pulse, providing additional corroboration of its use in fraudulent operations. The TLS certificate presented by the site is identified as grade E8, suggesting weak or misconfigured encryption that may be employed to evade scrutiny. As of the reporting date, the domain has been taken offline, limiting immediate exposure but leaving the underlying infrastructure potentially reusable.

Defenders should continue to monitor the IP address 102.209.117.25 for any re‑hosting activity, enforce blocklisting of the domain across network security appliances, and update endpoint and web‑gateway filters with the observed indicators of compromise. Further investigation is needed to determine the exact payload or phishing workflow employed, as no visual or content analysis is available beyond the page title. Until additional forensic evidence is obtained, the domain should be treated as a high‑risk brand‑impersonation vector targeting users of the 1inch platform.