satlayer[.]top

satlayer.top is a confirmed malicious domain impersonating an airdrop scam, specifically targeting cryptocurrency users with a fake $SLAY airdrop. The site is designed to trick visitors into connecting their wallets or providing sensitive information, likely leading to asset theft. This brand impersonation scheme leverages the popularity of airdrops to lure victims.

Technical analysis reveals several red flags. The domain was registered on March 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with low-quality or malicious domains. It resolves to IP address 172.67.201.236, which is shared with other suspicious sites. VirusTotal flags this domain with a score of 6/95, indicating that six security vendors classify it as malicious. Additionally, it appears on one security blocklist, and Google Safe Browsing likely marks it as unsafe. The site lacks an SSL certificate, meaning any data transmitted is unencrypted and vulnerable to interception.

As of the latest check, satlayer.top has been taken offline, which is a positive outcome. However, the domain remains registered and could be reactivated or redirected. Users should remain vigilant and avoid interacting with any content related to this domain. PhishDestroy recommends verifying all airdrop offers through official channels and never connecting wallets to untrusted sites. If you have already interacted with satlayer.top, monitor your accounts for unauthorized activity and consider revoking any permissions granted.