solairdrops-u5[.]netlify[.]app

Analysis indicates that solairdrops-u5.netlify.app is an active Netlify‑hosted site resolving to 63.176.8.218. The domain is associated with a fake airdrop campaign classified as a crypto drainer, a pattern where victims are prompted to connect cryptocurrency wallets and authorize transfers. Registration through Netlify suggests the attacker is leveraging the platform’s free hosting and automatic DNS, which explains the absence of explicit nameserver records. No public malware detections have been reported for the site, and VirusTotal scans returned no flags, but the lack of detections does not confirm safety. Content details have not been publicly disclosed, so the exact phishing page layout, credential capture mechanisms, or malicious scripts remain unknown. Defenders should assume the domain is hostile and incorporate it into URL filtering and DNS blocklists. Network monitoring should focus on outbound transactions to blockchain addresses originating from browsers that resolve this host, and any wallet‑connect API calls should be logged and examined. Because Netlify hosts many legitimate sites, consider applying threat‑intel‑based allow‑list exceptions only after thorough verification. Continuous re‑evaluation is advised as additional indicators may emerge.