codasshopevent[.]web[.]id

Analysis of codasshopevent.web.id shows an active high‑risk infrastructure used for a fake airdrop scheme. The domain was registered on 31 March 2026 through PT Dewabisnis Digital Indonesia and resolves to the Cloudflare‑managed address 104.21.25.193, located in Canada. A TLS certificate issued by Let’s Encrypt (E8) is present, and the site reports HTTP status 521 with the title "codasshopevent.web.id | 521: Web server is down," indicating the backend server is currently unreachable. Technical fingerprinting identifies PHP, Cloudflare services, and HTTP/3 support. Reputation data is poor: Gridinsoft assigns a trust score of 0/100, two of ninety‑four VirusTotal scanners flag the domain, and it appears on three public blocklists. The domain is already listed by PhishDestroy, MetaMask, and SEAL. Because the underlying content cannot be retrieved, the exact phishing payload remains unknown, but the combination of a recently created domain, low trust scores, and explicit fake‑airdrop labeling suggests an active credential‑harvesting campaign targeting cryptocurrency users. Defenders should block the domain and its IP at perimeter firewalls, add the host to DNS sinkhole lists, monitor outbound connections to the Cloudflare IP range for anomalous activity, and continue to watch for derivative subdomains that may be used in parallel campaigns.