Is apps-midnight.web.app a scam? TrustSniffer's high-risk assessment: 8/100

Overview

This website presents itself, under the title "Midnight | Bringing rational privacy to blockchain", as a web application for a privacy-focused blockchain project. It is served from a free, platform-issued "apps-midnight" subdomain, not from a standalone branded domain. Its apparent purpose is to draw visitors into a blockchain-related application experience under that project name.

Scam/Impersonation Risk

Independent threat-intelligence engines currently flag this host as malicious or suspicious, and the site is blacklisted by those sources. That makes this a confirmed contradiction, and it is decisive for the assessment. The site borrows a blockchain-project brand name on a disposable, platform-issued subdomain. Nothing observed ties it to the real operator of any such project, so the brand association should be treated as unverified. A separate set of abuse reports exists against one of the shared edge addresses serving the site. These reports concern infrastructure used by many tenants. They are a soft reputational signal and not proof of the site's own conduct. The site was also newly established when examined, with almost no archival footprint and no sustained operating history to counterbalance the flags. In the behavioural sandbox, the page restructured itself heavily after interaction, with a very large volume of DOM changes, and it contains multiple external-posting forms. The sandbox did not detect wallet-connection prompts, wallet-drainer behaviour, clipboard tampering, hidden forms, cloaking, or credential posts to external hosts. Those absences limit the observed behavioural harm but do not offset the blacklisting. No conflicting legal identities were found. Evidence:

• Homepage and hosting layer: three threat-intelligence engines classified the host as malicious and one as suspicious, with an external blacklist hit confirmed.
• Domain provenance: the domain is about 0.16 years old (roughly 60 days), with a single archive snapshot dated 2026-08-26 (1 year tracked).
• Homepage behaviour: 4,262 DOM mutations after interaction, 9 external-post forms, and 3 console errors across 3 successful runs.
• Shared edge address: 4 abuse reports from 2 distinct reporters, attributed to shared infrastructure and not discounted.

Regulatory Verification Notes

The site is not associated with any regulated entity, and no licence, registration number, or named operating company could be tied to it. Governance and ownership opacity are both present, so the real-world operator remains unidentified. This is a verification gap and not itself evidence of wrongdoing. Here it sits alongside confirmed blacklist hits, which gives the gap more weight. No third-party broker-review match exists for this site, so there is no outside reputational context either way. The site's transport encryption is valid, but a domain-validated certificate confirms only control of the hostname. It says nothing about who operates the site or whether it is legitimate. Evidence:

• Transport layer: the TLS certificate was issued by WR4 (DV validation), valid to 2026-12-22 with 57 days remaining.
• Hosting: served from AS54113 (FASTLY - Fastly, Inc., US), with the registry shown as ARIN.
• Homepage: the page carries about 5,649 characters of text, and no licence or registration disclosure was identified.

What to Verify Next

Before any engagement, confirm through the official channels of the genuine blockchain project that this subdomain is a sanctioned property, reaching those channels by an independently sourced route and not through links on this site. Any claimed operator, licence, or registration should be checked directly with the relevant registry. Official support and contact channels should be confirmed the same way, offline where possible. If a legitimate owner can be identified, the blacklisting should be raised with them, since it may reflect either abuse of the host or a compromise. Evidence:

• Homepage: it uses a project-style brand name on a platform-issued subdomain, with no operator named.
• Domain provenance: the very recent registration and single archive capture leave no independent history to check against.
• Behavioural testing: the external-posting forms found in the sandbox would need to be traced to their destinations before any data entry.

Summary Verdict

Available evidence supports a clearly cautionary, elevated-risk posture. Confirmed threat-intelligence listings, a very young domain with almost no history, and an unverified operator identity converge on a conclusion that the site cannot currently be treated as trustworthy. The valid encryption and absence of overt wallet-theft behaviour in testing are mitigating details and do not change that conclusion.

Infrastructure Integrity

The site sits behind Fastly's CDN. Every observed address, one IPv4 and one IPv6, is an edge node, and the origin server was not observable, so independent verification of the underlying host is not possible. This protective layer is a mitigating factor only. It improves availability and delivery but cannot offset the reputation risk, and edge-only visibility can also mask rapid content swaps.

Closing Assessment

Limit any interaction to passive viewing. Do not log in, connect a wallet, enter credentials, or make any financial transfer through this site until it is cleared and its operator is independently identified.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 3% confidence. The reports are attributed to shared infrastructure, not specifically to this website.