solairdrops-zm[.]netlify[.]app

Analysis of solairdrops-zm.netlify.app as of July 29 2026 indicates that the domain is currently active and associated with a crypto‑drainer campaign. The site is hosted on Netlify, as indicated by the registrar information, and resolves to the IPv4 address 63.176.8.218. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, suggesting that at least one threat‑intel feed has classified it as malicious. VirusTotal has processed the domain through 91 scanning engines; none of the engines reported a detection at the time of analysis, but the absence of a detection does not confirm benign behavior.

No DNS NS records were returned, shown as NS_NOT_FOUND, which may indicate misconfiguration or intentional concealment of authoritative name servers. No SSL certificate details, HTTP response codes, or page‑title information are available in the current intelligence set, leaving the surface‑level behavior of the web service undocumented. Defenders should treat the domain as high‑risk pending further investigation.

Recommended actions include adding the domain to outbound deny lists, monitoring DNS queries for the IP 63.176.8.218, and employing network‑level controls to block traffic to Netlify‑hosted endpoints that are not explicitly approved. Continuous re‑evaluation is advised, as additional telemetry such as request payloads, certificate fingerprints, or sandboxed execution results could clarify the malicious functionality. Until such evidence is obtained, the prudent stance is to assume the domain participates in unauthorized cryptocurrency extraction and to enforce strict egress filtering.