zeebu[.]app-airdropalert[.]lat

The domain zeebu.app-airdropalert.lat was registered through Dynadot LLC on November 10, 2025. DNS resolution points to IP address 142.250.188.4, an address owned by Google LLC (ASN 15169) located in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare's DNS service. No TLS certificate was presented during analysis, so the site operated over plain HTTP only.

The only page metadata retrieved is the title "Google," which aligns with the declared brand target of Google and the classified scam type of a crypto scam. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single public security blocklist. VirusTotal analysis recorded 14 detections out of 95 scanned security vendors, confirming that multiple reputable scanners consider the domain malicious. PhishDestroy has also blocked the domain, and the current operational status is offline.

The evidence suggests the domain was used to impersonate Google in a cryptocurrency‑related lure, likely attempting to convince victims that they were eligible for an airdrop. Uncertainty remains regarding the specific content delivered to visitors, such as whether credential‑capture forms or malicious payloads were present, because only the page title was captured before the site went offline. Defenders should continue to block DNS resolution to 142.250.188.4 for this host, add the domain to inbound/outbound URL filtering lists, and monitor for any re‑registration attempts. Threat intel feeds should be updated to include the domain and its associated indicators, and user awareness campaigns should warn against unsolicited Google‑branded airdrop alerts originating from unknown URLs.