solairdrops-qs[.]netlify[.]app

Analysis of solairdrops-qs.netlify.app shows an infrastructure consistently linked to a crypto‑drainer operation. The domain resolves to the IP address 35.157.26.135, which belongs to Netlify’s hosting platform; the registrar record confirms the site was provisioned through Netlify. No authoritative nameserver records are returned, indicating the domain relies on Netlify’s internal DNS management rather than a custom NS setup.

The site appears on a single security blocklist and is actively blocked by PhishDestroy, providing external confirmation of malicious intent. VirusTotal reports that the domain was examined by 91 scanning engines, none of which generated a detection at the time of review; this lack of alerts does not constitute a safety guarantee, as the payload may be delivered client‑side or through obfuscated scripts that evade static analysis. The current operational status is listed as active, meaning the domain continues to resolve and serve content.

No publicly available SSL/TLS details, HTTP response codes, or page‑title metadata were supplied, leaving the exact surface‑level behavior of the site unverified. Given the association with a crypto‑drainer classification, defenders should treat any interaction with the domain as high‑risk, enforce outbound traffic filtering to the hosting IP, and include the domain in URL‑reputation blocklists. Continuous monitoring of Netlify’s IP range for new malicious deployments and periodic re‑scans with dynamic analysis tools are recommended to capture any evolved payloads that may appear on the same infrastructure.