zeebu[.]airdropsalert[.]icu

Analysis of the domain zeebu.airdropsalert.icu indicates a brand impersonation campaign targeting Google, classified as a fake airdrop scam. The domain was registered on October 17, 2025, through Dynadot LLC and is currently offline as of the report date. Infrastructure analysis reveals the domain resolved to the IP address 142.251.40.132, geolocated in the United States under AS15169 (Google LLC), though this does not confirm legitimate affiliation. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com suggest Cloudflare was used for DNS management, a common practice among both legitimate and malicious actors to obscure hosting details.

Security vendor detections on VirusTotal show 14 of 95 engines flagged the domain as malicious, providing moderate confidence in its classification as a phishing threat. The domain appears on one security blocklist and is blocked by PhishDestroy, further supporting its malicious designation. The page title, 'Google,' aligns with the identified brand target, though the exact content and mechanics of the scam remain unconfirmed due to the domain's offline status. No SSL certificate was detected, increasing the likelihood of interception or manipulation of user data.

Defenders should treat this domain as part of a broader fake airdrop campaign impersonating Google. Given the elevated risk level and confirmed detections, organizations are advised to block the domain at the DNS or proxy level, monitor for related infrastructure (e.g., subdomains, similar IPs), and alert users to the risks of interacting with unsolicited airdrop promotions. The absence of an SSL certificate and reliance on Cloudflare nameservers may serve as additional indicators for future threat hunting.