crv[.]airdrpalerts[.]sbs

The domain crv.airdrpalerts.sbs presented a page titled "Google" and was classified as an impersonation scam specifically targeting the Gmail brand. The threat posed was a fraudulent attempt to deceive users into believing they were interacting with a legitimate Google or Gmail service, likely to capture login credentials or other sensitive information through a fake interface.

Technical analysis confirms the malicious nature of this domain. VirusTotal data indicates 9 out of 95 security vendors flagged the site as malicious. The domain was registered through Dynadot LLC and created on 2025-10-25. Its IP address is 172.217.18.4, hosted in the United States by AS15169 Google LLC. The site had no SSL certificate. It appeared on 1 blocklist and was flagged by ChainPatrol, CRDF, CyRadar, Fortinet, and G-Data. The nameservers used were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

As of the latest check, the domain is down or offline. The GridinSoft trust score is 0 out of 100, and the DOM risk score is 25, indicating a moderate risk profile. The site is no longer accessible, but its registration and hosting details suggest it was set up for short-term malicious use.