crv[.]airdropalerts[.]icu

This domain is flagged as a high-risk brand impersonation threat specifically targeting Gmail users. Analysis indicates the site mimics Google login pages, evidenced by the page title 'Google' and the domain’s creation for the explicit purpose of credential harvesting. The threat type aligns with phishing campaigns designed to deceive users into entering sensitive account information under false pretenses of legitimacy.

Infrastructure analysis reveals the domain was registered on October 14, 2025, through Dynadot LLC, a registrar commonly associated with malicious activity. It resolves to the IP address 142.250.185.228, located in the United States under AS15169 (Google LLC), though this IP association does not imply legitimate affiliation. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal reports 14 out of 95 security vendors detecting the domain as malicious. Notably, the domain lacks an SSL certificate, further reducing its perceived legitimacy and increasing the risk of interception during data transmission.

Mitigation requires immediate action to prevent credential theft. Network administrators should block the domain and its resolving IP at the firewall or proxy level. End-users should be educated to verify domain authenticity before entering credentials, particularly for login pages mimicking Google. Organizations should enforce multi-factor authentication (MFA) to mitigate the impact of stolen credentials. If exposure is suspected, affected accounts must be locked, passwords reset, and logs reviewed for unauthorized access attempts. Monitoring for similar domains registered via Dynadot LLC or resolving to the same IP range is recommended to preemptively address related threats.