crv[.]airdropsalert[.]bar

The domain crv.airdropsalert.bar is associated with a high-risk phishing scheme primarily involving brand impersonation of Google. This domain has been flagged for phishing activities, specifically targeting individuals with the intent of cryptocurrency scams. As of the latest update, the site has been taken offline, reducing the immediate threat it poses to users.

Technically, crv.airdropsalert.bar was created on October 20, 2025, and registered through Dynadot LLC. The domain resolves to the IP address 142.250.181.228, which is located in the United States under AS15169 Google LLC. Notably, 15 of 95 VirusTotal vendors, including ChainPatrol, alphaMountain.ai, and BitDefender, have flagged this domain for phishing. The domain is also listed on one security blocklist, specifically PhishDestroy. Google Safe Browsing has flagged it for 'SOCIAL_ENGINEERING'. The domain lacks an SSL certificate and uses nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The page title observed was 'Google'.

To mitigate risks from crv.airdropsalert.bar, individuals who may have interacted with this domain should take immediate action. If cryptocurrency wallets were involved, it is crucial to revoke any token approvals and move funds to a new wallet. For those who suspect credential phishing, changing passwords and enabling two-factor authentication is recommended. Additionally, users should monitor their accounts for any fraudulent activity. To report phishing, users can contact platforms like Google Safe Browsing or other relevant authorities to help prevent further incidents.