solairdrops-u6[.]netlify[.]app

Analysis of solairdrops-u6.netlify.app indicates that the domain is being used as a crypto‑drainer operation. The site is hosted on the Netlify platform, as reflected by the .netlify.app suffix, which typically provides a shared CDN edge and automated TLS termination. The domain has been listed on a security blocklist and was explicitly blocked by the PhishDestroy mitigation service, confirming that it is recognized by at least one reputable anti‑phishing vendor.

In addition, the domain was submitted to VirusTotal where 91 independent scanning engines evaluated the content; none of the engines reported a detection at the time of analysis. While the lack of detections may suggest that the payload has not yet been identified by automated signatures, the presence on a blocklist and the specific crypto‑drainer classification provide sufficient operational evidence of malicious intent. No public WHOIS record, SSL certificate details, HTTP response codes, or page‑title information are presently available, leaving the underlying infrastructure and exact phishing vector undocumented.

Consequently, defenders should treat the domain as hostile: network perimeter controls should deny any outbound or inbound traffic to the host, DNS filtering should be updated to block the domain, and endpoint security policies should include the domain in their blacklist. Continuous monitoring of Netlify‑related subdomains is advised, as threat actors frequently rotate hosting providers to evade attribution. Further forensic collection, such as retrieving the live page content and inspecting network traffic, would clarify the exact mechanism used to siphon cryptocurrency and support attribution efforts.