solairdrops-qk[.]netlify[.]app

The domain solairdrops-qk.netlify.app is currently active and has been classified as a crypto drainer. Infrastructure analysis shows the domain is registered through Netlify and resolves to the IP address 35.157.26.135, which belongs to the Netlify hosting platform. No authoritative name‑server records are returned, indicating the use of Netlify’s default DNS configuration. The domain’s status remains under investigation, and it continues to resolve to the same endpoint, suggesting the malicious payload or redirection infrastructure is still functional. Public intelligence does not provide a page‑level snapshot, so the exact content served by the site has not been disclosed. Consequently, the specific technique used to drain cryptocurrency—whether via malicious smart‑contract interaction, deceptive wallet address substitution, or other means—remains unknown. Defenders should block DNS resolution to 35.157.26.135 for this hostname, monitor outbound traffic for attempts to contact the domain, and enforce strict validation of any cryptocurrency address inputs in user‑facing applications. Threat‑intel feeds should be updated to include the domain as a malicious indicator, and security teams should consider adding it to web‑filtering and intrusion‑prevention rule sets. Continuous observation is recommended to detect any changes in hosting, IP address, or associated URLs that could indicate a shift in the campaign’s infrastructure.