solairdrops-mh[.]netlify[.]app

This domain, solairdrops-mh.netlify.app, is currently under investigation as a crypto drainer phishing site. As of July 29, 2026, the domain remains active and is hosted on Netlify infrastructure, resolving to IP address 63.176.8.218. Infrastructure analysis reveals the domain lacks configured nameservers, a potential indicator of ephemeral or misconfigured hosting often associated with malicious campaigns. The domain appears on one security blocklist and is actively blocked by PhishDestroy, though no detections were reported by the 91 vendors that scanned it on VirusTotal.

The absence of detections does not confirm safety, particularly given the domain's presence on a blocklist and its classification as a crypto drainer. Defenders should note that the domain's hosting provider, Netlify, is a legitimate platform frequently abused for phishing due to its ease of deployment and free tier. The IP address 63.176.8.218 may host additional malicious domains, warranting further investigation into associated infrastructure. While the exact content of the site has not been analyzed, the classification as a crypto drainer suggests it is designed to target cryptocurrency wallets, likely through deceptive airdrop or giveaway schemes.

Organizations should treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Monitoring for related domains or subdomains under the netlify.app namespace is recommended, as attackers often rotate through similar infrastructure. No additional brand or kit details are available at this time, and further analysis is required to determine the full scope of the threat.