solairdrops-lp[.]netlify[.]app

Analysis of solairdrops-lp.netlify.app indicates that the domain is actively being used as a crypto drainer and remains under investigation. The site is hosted on Netlify infrastructure, as confirmed by the registrar information, and resolves to the IP address 35.157.26.135. Network profiling shows the host belongs to a cloud service provider, which is consistent with Netlify's typical deployment model. The domain has been listed on one security blocklist and was flagged by the PhishDestroy mitigation service, demonstrating that at least one threat‑intelligence feed has identified malicious activity associated with the host.

No DNS NS records were returned, suggesting either a misconfiguration or deliberate omission of nameserver data, which can hinder passive DNS correlation. VirusTotal reports that the domain was scanned by 91 security vendors; none of the scanners raised a detection at the time of analysis, but the absence of detections does not constitute a safety guarantee. No additional data such as Safe Browsing verdicts, Open Threat Exchange (OTX) entries, SSL certificate details, HTTP response codes, or trust‑score metrics were available from the current intelligence set, leaving those vectors unverified. Defenders should continue to monitor the IP 35.157.26.135 for any outbound cryptocurrency transaction attempts and enforce network‑level controls that block connections to this host.

Incorporating the domain into internal blocklists, updating intrusion‑prevention signatures, and applying URL filtering policies that reference the observed blocklist entry are recommended. Because the domain is still active, organizations should also review endpoint logs for any process that initiates connections to the Netlify endpoint and consider sandboxing or isolating suspicious payloads that may be delivered from this host.