solairdrops-2d[.]netlify[.]app

solairdrops-2d.netlify.app was observed on 2026-08-02 as an active crypto‑drainer infrastructure. The domain is hosted on Netlify’s static‑site service, indicated by the “.netlify.app” suffix, and resolves to Netlify’s shared IP ranges. No malicious payload was retrieved, but the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed.

VirusTotal records show the URL was submitted to 91 scanning engines; none of the engines raised a detection at the time of analysis. While the absence of a detection does not imply safety, it demonstrates that the current signatures do not yet recognize the site’s behavior. The site’s page title, target brand, and content have not been publicly disclosed, so the exact impersonation technique remains unknown.

Investigators have not identified any SSL certificate anomalies; the site presents a valid HTTPS certificate issued to the Netlify domain, which is typical for legitimate Netlify deployments. The lack of observed malicious code means that attribution relies on the blocklist entries and the classification of the domain as a “crypto drainer.” Defenders should continue to deny connections to the domain at the network perimeter, add the host to URL filtering policies, and monitor DNS queries for the “solairdrops-2d.netlify.app” name. Ongoing telemetry collection, including sandbox execution of any downloaded payloads and correlation with known crypto‑drainer indicators, is recommended to confirm the threat’s intent and to update detection rules.