crv[.]airdropalerts[.]bond

The domain crv.airdropalerts.bond is a confirmed phishing site engaged in brand impersonation, specifically targeting Google as part of an airdrop scam. This site posed an elevated risk by mimicking Google’s branding to deceive users into disclosing sensitive information or engaging with fraudulent airdrop offers. No crypto drainer kit was associated with this campaign. As of the latest verification, crv.airdropalerts.bond has been taken offline.

Technical indicators confirm the malicious nature of crv.airdropalerts.bond. The domain was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and SOCRadar, and was actively blocked by Google Safe Browsing for 'SOCIAL_ENGINEERING'. It appeared on 1 security blocklist (PhishDestroy) and was registered through Dynadot LLC on October 14, 2025. The domain resolved to the IP address 142.250.80.36, hosted on Google LLC’s infrastructure (AS15169), with no SSL certificate issued. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and the observed page title was 'Google'. Gridinsoft assigned a trust score of 0/100 to the domain.

Users who interacted with crv.airdropalerts.bond should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized activity. If financial or crypto assets were involved, review transaction histories for suspicious activity. Report the domain to Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in takedown efforts. Victims may also file complaints with the registrar, Dynadot LLC, to support further investigation.