app-zoobit[.]org

The domain app-zoobit.org was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 104.21.64.244 located in the United States. The site presented the page title “ZooBit - Next Generation Staking” and was identified as a fake airdrop campaign that impersonates the across brand. Automated scanning by VirusTotal returned 11 positive detections out of 93 security vendors, indicating that a substantial minority of scanners consider the domain malicious. The TLS certificate is issued by Google Trust Services under the WE1 root, which is typical for Cloudflare‑protected sites and does not by itself imply legitimacy.

HTTP requests receive a 403 response, and the domain is currently taken offline; PhishDestroy has already blocked it, and it appears on one external blocklist. The infrastructure uses Cloudflare’s DNS with the nameservers braden.ns.cloudflare.com and wally.ns.cloudflare.com, and the site served over HTTP/3. Analysis confirms that the domain is being used for brand‑impersonation via a fake airdrop lure, but the exact content of the landing page has not been captured because the site is offline. Consequently, details such as the specific phishing form, credential‑capture mechanisms, or any embedded malicious payload remain unknown.

Defenders should add app-zoobit.org to internal blocklists, monitor DNS queries for the associated Cloudflare nameservers, and enforce outbound filtering that blocks connections to the resolved IP 104.21.64.244. Security teams should also flag any email or social‑media messages that reference a “ZooBit” airdrop, especially those that direct users to the domain or to URLs that resolve to the same Cloudflare IP range. Continuous re‑scanning of the domain on VirusTotal and similar services is advised, as additional detections may surface if the operator re‑activates the site.