airdrop-solaxy[.]fi

The domain airdrop-solaxy.fi is a phishing site designed to deploy a crypto drainer, a type of malware that automatically siphons cryptocurrency from connected wallets. It does not impersonate a known brand and no specific drainer kit has been identified. The site is currently taken offline, but it previously posed an elevated risk to users who interacted with it.

Technical indicators show that airdrop-solaxy.fi was flagged by 2 of 95 VirusTotal security vendors, including G-Data and Gridinsoft. It was listed on 5 security blocklists, including PhishDestroy, ScamSniffer, and Polkadot. The domain was created on February 21, 2026, and resolved to the IP address 172.67.200.225, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Solaxy Token: $SOLX Claim is Live'. Nameservers were kia.ns.cloudflare.com and louis.ns.cloudflare.com. No registrar information is available.

Users who connected a wallet to airdrop-solaxy.fi should immediately revoke all token approvals using a tool like Revoke.cash or Etherscan's token approval checker. Move remaining funds to a new, secure wallet. Report the domain to platforms such as ScamSniffer, PhishDestroy, or the Anti-Phishing Working Group (APWG) to assist in takedown efforts. Monitor transaction history for unauthorized activity and enable two-factor authentication on all accounts as a precaution.