zeebu[.]airdropsalert[.]us

Analysis of zeebu.airdropsalert.us indicates a recent domain created on 18 October 2025 and registered through Dynadot LLC. The domain resolves to IP address 142.251.179.105, which belongs to the AS15169 Google LLC network in the United States, a common tactic for brand‑impersonation campaigns that exploit trusted hosting ranges. No TLS certificate is presented, meaning the site would have been served over plain HTTP, a characteristic often observed in low‑effort crypto‑scam deployments. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming that the domain is fronted by Cloudflare’s DNS infrastructure. Threat intelligence sources flag the domain as a crypto‑scam that impersonates Google.

The page title returned by the HTTP response is the literal string “Google”, directly aligning with the claimed brand target. VirusTotal reports that 12 of 93 scanning vendors have identified the domain as malicious, and it appears on a single security blocklist. Independent blocklist providers, including PhishDestroy, have already taken the domain offline and added it to their blocklists. Additional reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The combination of a brand‑matching title, absence of encryption, low trust score, and multiple vendor detections suggests a high likelihood that the site was used to lure victims into a cryptocurrency‑related fraud, possibly by promising airdrops or other incentives. Because the site is currently offline, active exploitation cannot be confirmed, but the infrastructure remnants remain usable for future campaigns. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat‑intel feeds with the observed indicators, and monitor for any re‑registration or DNS changes that could revive the site.