solairdrops-vn[.]netlify[.]app

solairdrops‑vn.netlify.app is observed as an active crypto‑drainer infrastructure as of 16 July 2026. The domain is hosted on Netlify, indicated by the registration pathway, and resolves to the IPv4 address 63.176.8.218. No authoritative name server records are returned (NS_NOT_FOUND), which may hinder typical DNS‑based remediation. The domain has been submitted to VirusTotal and examined by 91 scanning engines; none have generated a detection at the time of analysis, but the absence of alerts does not constitute validation of benign intent. The threat classification derives from intelligence linking the domain to cryptocurrency draining campaigns, though the exact payload or phishing page content has not been publicly disclosed. Consequently, the primary uncertainty lies in the operational details of the drainer—whether it employs malicious smart‑contract interactions, malicious wallet address substitution, or other techniques. Defenders should block network traffic to 63.176.8.218, add the fully qualified domain to URL filtering lists, and monitor for anomalous cryptocurrency transactions originating from internal hosts. Continuous re‑scanning of the domain with updated threat feeds is recommended to capture any future detections. Given the active status and lack of definitive remediation evidence, the domain remains under investigation.