Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
cropper-dex.net shows high-risk / scam indicators.
| What this site appears to be | Cropper Finance presents itself as a Solana trading protocol offering token swaps, concentrated-liquidity pools, SOL and CRP staking, and a CRP governance token. It advertises 31.4% top pool APR, 18.5% CRP vault APY, '#1' status, audits by named firms, and formal verification, but none of these claims are linked to verifiable evidence. No legal entity, jurisdiction, or contact address is shown. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 12% confidenceAbuseIPDB, 5 reports; shared hosting inflates reports | Clear |
| Domain age | 3 months oldMost scam domains are under a year old | Risk |
| Certificate | Encrypted connectionIssued by YR2 | Noted |
| Hosted by | IQWEBServer in AE | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- VirusTotal and Google Safe Browsing had no flags for this domain; its hosting IP carries AbuseIPDB reports below the confidence level TrustSniffer treats as a flag.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
Cropper Finance, served from the domain cropper-dex.net, is a single-page Solana DeFi landing site branded "#1 Trading Platform on Solana". It presents a token-swap widget, concentrated-liquidity pools, SOL and CRP staking, and a CRP governance token. Its visible purpose is to draw visitors into connecting a crypto wallet and depositing assets to swap, provide liquidity or stake. The site says it earns from a 0.04% swap fee and pool fees that are passed on to liquidity providers and CRP stakers.
Scam/Impersonation Risk
The evidence shows confirmed contradictions that call for a security-forward reading. A tier-one security vendor flags the domain, and two further engines mark it suspicious. This places it on an external blacklist. A separate set of abuse reports is attached to the shared data-center address that serves the site. That reporting concerns the hosting address, not the site itself, and the two should not be conflated. Even so, it adds to the reputational weight. The site gives no sign of impersonating a known brand and has no login or credential form. The concern is its financial proposition and the age of the domain. The homepage advertises a top pool APR of 31.4% and an 18.5% CRP vault APY under the label "real yield". It also claims "No emissions inflation", yet it pays those rewards in the CRP token it issues. The source of the yield is therefore never reconciled. The homepage also presents a $640M total value locked, $4.8B in cumulative volume and "420K+ unique wallets". It states "Lowest on Solana" for its fee and uses a "#1" title. None of these figures links to an on-chain explorer or an independent source. The domain was also registered only months ago, so the site presents itself as a mature, high-volume protocol without any matching operating history. The behavioural sandbox found no wallet-drainer activity, no clipboard hijacking and no external data posts. That limits the technical evidence of active theft, but it does not offset the reputation and claim-integrity findings. Wallet interaction was not exercised in the sandbox.
- Homepage: top pool APR of 31.4% and CRP vault APY of 18.5% are promoted, while the same page states no emissions inflation and pays rewards in the project's own token.
- Homepage statistics strip: $640M TVL, $4.8B volume and 420K+ wallets are shown with no linked verification. A DeFi protocol tracker lookup returned no listing for the protocol.
- Domain registration: registered 2026-07-30 (~0.22 years, about 82 days old) through the registrar Atak Domain, which is inconsistent with the scale the homepage claims.
- Reputation: one tier-one security vendor detection and two suspicious detections; 5 abuse reports against the shared hosting IP, with no discount applied.
Regulatory Verification Notes
The site identifies no legal entity, jurisdiction, team or registered address. It claims no financial license or registration, and no regulator is named. This is a verification gap, not proof of wrongdoing. The gap carries real weight here, though, because the site asks visitors to deposit assets before any service is delivered, with no accountable counterparty to turn to. Registration data is complete but generic, so it does not connect the site to any identifiable operator. Real-world identity therefore remains unverified. No third-party broker or regulatory listing matches this domain. The transport layer is a basic domain-validated certificate. It confirms an encrypted connection but says nothing about who runs the site.
- Homepage, footer and navigation (Swap, Pools, Staking, Features, Security, FAQ, Docs): no company name, license number, jurisdiction or contact address is given.
- Hosting: served from AS59692 (IQWeb FZ-LLC), a data-center provider in the United Arab Emirates.
- TLS: certificate issued by YR2 (DV), valid to 2026-10-28.
- Registrant record: lists only a generic "Domain Administrator" for the domain's registrant.
What to Verify Next
Any engagement should first rest on independent proof that the protocol exists. The homepage Security section names four audit firms (Otter Security, Halborn, OtterSec with Neodyme, and Trail of Bits). It also asserts formal verification and "zero incidents". Each claim should be checked directly with the named firm, and the audit report should be matched to the contract address the site actually uses. The claimed TVL and the CRP token supply and emissions should be checked on-chain against the contracts, not against the figures on the page. The 31.4% and 18.5% yields should be traced to an identifiable source of revenue. Official channels and the operating entity should be confirmed through an independent, offline route, not through links on the site itself.
- Homepage Security section: four named audit firms plus formal-verification and zero-incident claims, with no linked reports.
- Homepage swap widget and staking panels: Swap, Pool and Stake actions all require wallet connection, so contract addresses must be confirmed before any connection.
- Documentation and FAQ navigation entries point to resources that were not evidenced as independent.
Summary Verdict
The site carries an elevated-risk posture. External security detections converge with an unproven, aggressively marketed yield proposition and a very young domain. The sandbox found no active malicious behaviour. That is far outweighed by the threat intelligence and claim-integrity concerns. Its legitimacy cannot be established on the available evidence.
Infrastructure Integrity
The site sits on a single address at a data-center hosting provider. It has no CDN or WAF in front of it, so the origin server is directly reachable and no protective layer mitigates the risk. The network location and registry do not match, and the young, thinly populated domain footprint is consistent with newly stood-up infrastructure. These are unconfirmed heuristics and not established risks. The hosting itself provides no assurance about the operator.
Closing Assessment
The site should not be used for wallet connection, deposits, swaps, staking or any other financial interaction. Viewing it without connecting a wallet is the only proportionate use. Anyone who has already connected a wallet or sent funds should revoke token approvals and move remaining assets to a fresh wallet.
Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by external reputation, page content.
01 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
02 Page content
- The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The page content shows three or more warning signs that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_STRONG - The review of the page content rated it moderate risk.Page content
rule:PAGE_RISK_MED - The page content shows at least one warning sign that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_SOME
Signals weighed against the site
- AbuseIPDB: 5 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 12% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of cropper-dex.net.
- The request stayed on cropper-dex.net. It was not redirected to another domain. Clear
- Registration is published under Atak Domain. Clear
- DNS for this domain is served by trustname.com, across 2 name servers. Noted
- The registration is paid up to 2027-07-30. Noted
- It is hosted on IQWEB, from a server in AE. Noted
Domain intelligence
| Registrar | Atak Domain |
|---|---|
| Hosting | IQWEB - IQWeb FZ-LLC, AE |
| Country | AE |
| Server IP | 186.2.175.35 |
| Name servers | ARES.TRUSTNAME.COM, ZEUS.TRUSTNAME.COM |
| CDN / edge network | Not detected |
| Resolved IP addresses | 1 |
| Edge IP addresses | 0 |
| Likely origin IP addresses | 1 |
| SSL issuer | YR2 |
| SSL expiry | 2026-10-28 |
| Domain age | 0.22 years (continuous registration) |
| Domain expiry | 2027-07-30 |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 12% confidence, 5 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about cropper-dex.net at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.