airdropsolaxy[.]app

PhishDestroy identifies airdropsolaxy.app as an active crypto drainer scam impersonating the legitimate Airdrop Scam brand. This domain (created March 22, 2026) is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP 188.114.96.3. The site currently shows 3/95 detections on VirusTotal, indicating it remains under the radar of major security vendors while actively targeting cryptocurrency users through brand impersonation tactics. Technical indicators reveal this domain employs a Let's Encrypt SSL certificate to appear legitimate, despite its fraudulent nature. The recent creation date suggests a rapidly deployed threat, while the lack of detections highlights the importance of proactive threat hunting. The domain’s infrastructure (188.114.96.3) has not been widely blocked, making it particularly dangerous for unsuspecting users. The impersonation of a well-known brand further amplifies the risk of credential theft and financial loss. To mitigate exposure, cryptocurrency users should immediately block airdropsolaxy.app at the network level and avoid interacting with any Airdrop Scam promotions from this domain. Organizations should update threat intelligence feeds with this IOC and scan for internal DNS resolutions to 188.114.96.3. Users are advised to verify all crypto-related URLs through official channels and enable wallet protections against drainer scripts. Report this domain to your security team and cryptocurrency platform providers to prevent further propagation.