crv[.]airdropsalert[.]xyz

The domain crv.airdropsalert.xyz has been identified as a brand impersonation threat, specifically targeting the Google brand. The domain was registered through Dynadot LLC and was used to impersonate Google with a page title identical to the legitimate brand, potentially misleading users into believing they are interacting with a genuine Google service.

Technical indicators reveal that the domain crv.airdropsalert.xyz was created on October 17, 2025, and resolves to the IP address 142.250.184.228. On VirusTotal, 12 out of 95 security vendors have flagged this domain, indicating a significant level of suspicion. The domain is also listed on one security blocklist and has a Gridinsoft trust score of 0/100, further corroborating the elevated risk level. The domain was registered through Dynadot LLC.

Currently, the domain crv.airdropsalert.xyz is offline, which suggests that the threat has been neutralized or that the domain has been taken down by security measures or domain registrar actions. Despite the domain being offline, users should remain cautious as the infrastructure could be reactivated. The risk remains elevated, and users are advised to verify the authenticity of any communication or web pages that appear to be from Google, especially if they are directed to unfamiliar URLs or prompted to enter personal information.