crv[.]airdrpsalert[.]click

On July 25, 2026, the domain crv.airdrpsalert.click was observed to host a brand‑impersonation campaign targeting Google. The domain was registered on October 26, 2025 through Dynadot LLC and is currently marked as taken offline. DNS resolution points to the IPv6 address 2a00:1450:4001:80f::2004, which belongs to the AS15169 network operated by Google LLC and is geolocated in Germany. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating that the domain leveraged Cloudflare’s DNS infrastructure. No TLS certificate was presented; the site served without HTTPS.

The page title returned by the web server is “Google”, matching the declared brand target. The domain is listed on a single security blocklist and was blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis recorded three detections out of ninety‑five scanning engines, confirming that multiple security vendors have flagged the domain as malicious.

The limited detection count suggests that the campaign may have been short‑lived or targeted a narrow audience before the infrastructure was taken down. Defenders should continue to monitor the associated IPv6 address and the Cloudflare name servers for any re‑use, update firewall and DNS filtering policies to block crv.airdrpsalert.click, and consider adding the address to internal blocklists. Because the site is currently offline, active probing is not possible, and the exact payload or credential‑harvesting mechanism remains unknown. Ongoing intelligence collection should focus on any newly observed subdomains under the same registrar or name‑server configuration that could indicate a resurgence of the campaign.