zeebu[.]airdropsalert[.]pro

Analysis of zeebu.airdropsalert.pro indicates a crypto scam domain impersonating Facebook, operational as of July 23, 2026, though currently offline. The domain was flagged by 14 of 95 security vendors on VirusTotal, suggesting moderate detection coverage. No SSL certificate was present, increasing the risk of unencrypted data transmission. Infrastructure analysis reveals the domain resolved to IP 172.217.18.4, hosted under AS15169 (Google LLC) in the US, though this IP is commonly associated with legitimate Google services, which may complicate automated detection.

The domain was registered through Cloudflare, Inc., but nameserver records (NS_NOT_FOUND) indicate misconfiguration or incomplete setup. The page title, 'Google,' does not align with the impersonated brand (Facebook), suggesting either a placeholder or an attempt to evade keyword-based detection. The domain appears on one security blocklist and was actively blocked by PhishDestroy prior to being taken offline. Defenders should treat this domain as a confirmed impersonation threat, particularly given its association with crypto scams.

While the current status is offline, the infrastructure and registration details warrant continued monitoring for potential re-emergence. Network defenders are advised to block the domain and IP at perimeter controls, and to review logs for prior connections to this address. Further investigation into the hosting provider and registrar may reveal additional related domains or infrastructure.