zeebu[.]airsdropsalerts[.]lol

The domain zeebu.airsdropsalerts.lol was registered on 7 November 2025 through Dynadot LLC. Its authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to the IPv4 address 142.251.140.164, which belongs to the AS15169 block owned by Google LLC and is geolocated in the United States. The site’s HTTP endpoint is currently offline, and no TLS certificate is presented, meaning the domain does not support HTTPS. Public threat intelligence flags the domain as a brand‑impersonation campaign targeting Google. The page title returned by the live probe was simply “Google”, matching the declared brand target.

Gridinsoft’s trust scoring system assigned a score of 0 out of 100, reflecting a maximum risk rating. VirusTotal analysis recorded 11 detections out of 95 scanned engines, and the domain appears on at least one external security blocklist. PhishDestroy has also listed the domain as blocked. No content was captured because the host responded with no data; therefore the exact phishing kit or credential‑harvesting mechanisms remain unknown.

Absence of an SSL certificate prevents verification of any potential spoofed login pages, and the offline status limits real‑time observation of malicious payloads. Defenders should continue to block the domain at perimeter filters, update web‑proxy and DNS blocklists, and monitor for any future re‑activation of the host. Incident response teams should watch for related sub‑domains or DNS changes pointing to the same IP range, and consider adding the IP address to reputation‑based blocking rules. Organizations using Google services should educate users about unsolicited communications that reference the domain, despite its current offline state.