solairdrops-rh[.]netlify[.]app

Analysis of solairdrops-rh.netlify.app, observed on July 23, 2026, indicates that the domain is actively used in a crypto‑drainer campaign. The domain resolves to the IPv4 address 35.157.26.135, which is associated with Netlify’s hosting infrastructure. Registration information shows the domain was provisioned through Netlify, and the nameserver query returned NS_NOT_FOUND, suggesting that standard DNS records are either hidden or not publicly resolvable.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least one trusted threat‑intelligence source has flagged it as malicious. VirusTotal has processed the domain with 91 vendor scanners; none of the vendors reported a detection, but the absence of a flag does not constitute evidence of benign behavior. No additional intelligence such as page title, brand targeting, or kit fingerprints is available, leaving the exact phishing lures and victim‑facing content unverified.

Given the confirmed blocklist entry, the association with a known crypto‑drainer threat type, and the active status, defenders should treat the domain as hostile. Recommended mitigations include adding the domain to network deny lists, configuring web‑proxy blocks, and monitoring outbound traffic for connections to 35.157.26.135. Continuous re‑evaluation is advised in case new detections or content analysis emerge.