crv[.]app-airdropalert[.]sbs

This domain, crv.app-airdropalert.sbs, was created on 10 November 2025 and is currently offline. Infrastructure analysis shows it resolves to IP 142.251.167.103, which belongs to AS15169 Google LLC in the United States, indicating the attacker leveraged a legitimate Google‑owned address to increase perceived trust. The domain is registered through Dynadot LLC and uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is present, so the site would have been served over plain HTTP.

The page title returned was “Google”, matching the declared brand target and confirming a brand‑impersonation intent focused on Google. VirusTotal scanning recorded 14 detections out of 95 security vendors, and Gridinsoft assigned a trust score of 0 / 100, both consistent with malicious classification. The domain has been blocked by PhishDestroy and appears on one additional security blocklist. While the exact payload or redirection flow has not been captured, the available indicators suggest a crypto‑scam campaign that pretends to be a Google service, likely to lure victims into sending cryptocurrency.

Defenders should add crv.app‑airdropalert.sbs to URL filtering and DNS block lists, monitor for any resurgence, and verify that internal traffic to the associated IP address is inspected. Continuous observation of the associated Cloudflare nameservers and the Dynadot registrar for new domains employing similar patterns is advised. Because the site is offline, immediate takedown actions are not possible, but threat‑intel sharing with industry partners can help prevent reuse of the same infrastructure.