solairdrops-io[.]netlify[.]app

This domain, solairdrops-io.netlify.app, is currently active and has been identified as a crypto‑drainer infrastructure. The site resolves to the IPv4 address 63.176.8.218 and is hosted on Netlify, as indicated by the registrar information. Netlify’s hosting platform does not expose traditional nameserver records; the domain’s NS query returns NS_NOT_FOUND, which limits passive DNS correlation. The domain appears on three public blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL blocklist services, confirming that multiple threat‑intelligence feeds have flagged it for malicious activity.

VirusTotal records show that the URL was submitted to 91 scanning engines; at the time of analysis none of the engines returned a detection, but the absence of a positive result does not constitute a safety guarantee. No SSL certificate information, HTTP response codes, or page title data are available from the current intelligence set, leaving the surface‑web characteristics of the site unverified. The lack of a published page title or content snapshot prevents confirmation of the exact phishing lure or the specific cryptocurrency wallet addresses targeted. Likewise, there is no evidence of attribution to a known malware kit or campaign.

Defenders should continue to block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP address, and consider adding the domain to internal blacklists. Because the infrastructure is hosted on a shared cloud service, additional malicious sites may share the same IP range; network‑level filtering should therefore be applied with caution to avoid over‑blocking legitimate Netlify traffic. Ongoing telemetry collection, including periodic re‑scanning on VirusTotal and checking for updates on blocklist memberships, is recommended to capture any evolution in the threat profile.