crv[.]airdropalert[.]us

The domain crv.airdropalert.us was registered on 19 October 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to 142.250.176.196, an address owned by AS15169 Google LLC in the United States. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was presented when the site was reachable, indicating an HTTP‑only service. The page title returned “Google”, matching the declared brand target of Google and confirming the intent to impersonate that brand.

Google Safe Browsing classifies the site as social engineering, and VirusTotal reports 11 of 93 scanners flagging the domain for malicious activity. The site was listed on a single security blocklist and was blocked by the PhishDestroy feed. Gridinsoft assigned a trust score of 0 / 100, reinforcing the high‑risk assessment. The listed scam type is a crypto scam, suggesting the site may have attempted to lure victims into cryptocurrency‑related fraud.

Because the site is no longer reachable, static content cannot be examined, leaving the exact phishing payload and credential‑capture mechanisms uncertain. Defenders should continue to block the domain at DNS and proxy layers, add it to URL filtering rules, and monitor the associated IP range for any new domains that resolve to the same address. Ongoing observation of Cloudflare name‑server changes is advised, as attackers often reuse the same resolver configuration for future campaigns. The combination of brand impersonation, social‑engineering Safe Browsing flag, multiple vendor detections, and a zero trust score warrants a high‑severity indicator in threat‑intel feeds.