cropycoininfo2[.]pages[.]dev

The domain cropycoininfo2.pages.dev was registered on March 28, 2026 and is hosted on Cloudflare Pages, resolving to the Cloudflare edge IP 188.114.97.3 located in Canada. The site serves a fake airdrop campaign for "CropyCoin" as indicated by the page title "CropyCoin | Platform Airdrop dan Kripto Inovatif Berbasis Blockchain" and the identified phishing kit labeled "Airdrop Scam." The SSL certificate is issued by Google Trust Services under the WE1 authority, and the HTTP response returns a 200 status code. Threat intelligence flags this infrastructure as active and assigns a high risk rating. The domain appears on one security blocklist and is currently blocked by PhishDestroy. VirusTotal analysis shows that 3 of 94 security vendors have flagged the domain, while Gridinsoft assigns a trust score of 0/100, reinforcing the malicious classification. Evidence confirms the use of a fake airdrop lure, but the exact payload or credential‑harvesting mechanisms have not been publicly disclosed. Defenders should block the domain at network perimeters, monitor DNS queries for the associated IP, and update endpoint detection rules to include the observed SSL issuer and HTTP characteristics. Continuous monitoring of threat feeds for additional indicators of compromise is recommended.