solairdrops-8z[.]netlify[.]app

Analysis of solairdrops-8z.netlify.app indicates that the domain is actively used in a crypto‑drainer campaign. The site is hosted on Netlify, as evidenced by the registration information and the resolved address 35.157.26.135, an IP range owned by Netlify’s infrastructure. No authoritative nameserver records were returned, which is consistent with Netlify’s default DNS handling. The domain appears on a single security blocklist and is flagged by the PhishDestroy service, confirming that at least one external sink has identified malicious activity.

VirusTotal has processed the domain with 91 scanning engines and reported no detections; however, the lack of a positive match does not imply benign intent and should not be taken as validation of safety. The threat type is classified as a crypto drainer, suggesting that the site likely attempts to trick users into transferring cryptocurrency to attacker‑controlled wallets. Concrete details about the page content, SSL configuration, or HTTP response codes are not currently available, leaving the exact attack vector and victim interaction unknown.

Defenders should treat the domain as hostile: block the domain and its associated IP at network perimeters, add it to host‑based deny lists, and monitor DNS queries for any resurgence. Continuous re‑scanning with multi‑engine services is advised, as the site may evolve or adopt new payloads. Integration of this indicator into threat‑intel platforms will improve detection of related campaigns that reuse Netlify hosting or similar free‑service infrastructures.