soldrop[.]icu

This domain, soldrop.icu, operates as a crypto wallet drainer phishing site designed to exploit users attempting to connect or interact with cryptocurrency wallets. The site employs malicious JavaScript to hijack wallet sessions, drain funds, or harvest sensitive credentials such as private keys and recovery phrases. Infrastructure analysis reveals the use of modern frontend frameworks, including Node.js, Vue.js, and Nuxt.js, which may be leveraged to obfuscate malicious payloads or simulate legitimate wallet interfaces. The presence of tracking technologies like Facebook Pixel and Cloudflare Browser Insights suggests an attempt to profile victims or optimize the phishing campaign’s effectiveness.

Technical evidence confirms the domain’s malicious intent. soldrop.icu is flagged by 7 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines. It appears on three independent security blocklists, further validating its classification as a phishing threat. The domain was registered on May 28, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which is part of a network infrastructure known for hosting phishing and scam-related content. The page title, 'Black Background,' is a common placeholder used in phishing sites to avoid immediate detection by automated scanners.

Users who visited soldrop.icu or interacted with its content should take immediate action to mitigate potential risks. Disconnect any cryptocurrency wallets linked to the site and revoke permissions for all connected decentralized applications. Scan the device for malware, as phishing sites may deploy additional payloads. Monitor wallet transactions for unauthorized activity and consider transferring funds to a new wallet if suspicious behavior is detected. Report the domain to relevant security communities or blockchain security platforms to aid in broader threat mitigation efforts.