solairdrops-t2[.]netlify[.]app

The domain solairdrops-t2.netlify.app is currently active and has been identified as a crypto drainer operation. Infrastructure analysis shows the domain is hosted on Netlify and resolves to the IPv4 address 35.157.26.135. Netlify’s registration service is listed as the registrar, and DNS queries return no nameserver records, indicating that the domain relies on Netlify’s default DNS configuration. The domain appears on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering platforms, underscoring its classification as a high‑risk threat.

VirusTotal reports that the domain has been scanned by 91 antivirus and URL‑reputation vendors; none of the vendors have raised a detection at the time of analysis. The lack of detections does not constitute evidence of benign behavior, and the presence on multiple blocklists should be taken as a stronger indicator of malicious intent. No public SSL certificate details, HTTP response codes, or page‑title information are available, limiting the ability to assess the surface‑level characteristics of the hosted content. Defenders are advised to deny any network traffic to solairdrops-t2.netlify.app and to block outbound connections to its hosting IP 35.157.26.135.

Because the site is hosted on a shared Netlify infrastructure, broader egress filtering for the Netlify domain space may reduce exposure to similar campaigns. Continuous monitoring of the domain’s status on blocklists and periodic re‑scanning with URL reputation services are recommended to detect any future changes in detection posture. Organizations should also educate users about crypto drainer scams, emphasizing that unsolicited requests for cryptocurrency transfers are characteristic of this threat vector.