solairdrops-ec[.]netlify[.]app

solairdrops-ec.netlify.app is hosted on Netlify's infrastructure and resolves to the Amazon Web Services IP address 35.157.26.135. The domain was created using Netlify's automated registration service, and no authoritative name server records are publicly visible. The site is currently active and classified as a crypto drainer that distributes a fake airdrop, a common vector used to lure victims into providing private keys or sending cryptocurrency. VirusTotal analysis shows the URL was submitted to 91 scanners, none of which flagged the page at the time of review, but the absence of detections does not guarantee the content is benign. The threat actor likely relies on Netlify's static‑site hosting to serve a minimal HTML page that redirects users to a malicious wallet address or prompts them to install a malicious browser extension. No additional infrastructure such as command‑and‑control servers, external CDN endpoints, or suspicious TLS certificates has been observed, leaving the full attack chain uncertain. Defenders should block or monitor DNS queries for the domain, enforce strict outbound transaction controls for cryptocurrency wallets, and treat any unsolicited airdrop offers originating from this or similar Netlify‑hosted domains as malicious. Ongoing investigation should focus on capturing request payloads, identifying any linked wallet addresses, and correlating traffic with known crypto‑drainer campaigns.