airdrop[.]zebec[.]zone

Analysis indicates that airdrop.zebec.zone is associated with a crypto‑draining scam. The site was blocked by PhishDestroy and appears on a single security blocklist, confirming that it has been identified as malicious by at least one reputable sinkhole. VirusTotal records show that 1 of 95 scanning engines flagged the domain, providing independent vendor corroboration of malicious intent. The page title returned by the HTTP response is “Nur einen Moment…”, which does not reveal any legitimate service and is consistent with a placeholder often used by fraudulent pages. Infrastructure observations reveal that the domain resolves to 188.114.96.3, an address owned by AS13335 (Cloudflare, Inc.) located in the United States.

Both authoritative name servers, earl.ns.cloudflare.com and melody.ns.cloudflare.com, belong to Cloudflare, indicating the use of Cloudflare’s DNS and CDN services. The TLS certificate is issued by Google Trust Services under the “WE1” profile, a standard certificate that does not indicate compromise but also does not provide trust signals for the content. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, all typical of sites routed through Cloudflare’s edge network. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar commonly used for bulk registrations. Gridinsoft assigned a trust score of 0 / 100, reinforcing the low confidence in the site’s legitimacy.

The scam classification is listed as “Crypto Scam”, aligning with the observed pattern of domains that solicit cryptocurrency transfers and then disappear. The current status is offline, suggesting the operators have taken the site down, possibly after detection or after completing their campaign. Uncertainties remain regarding the exact payload or transaction mechanisms used, as no additional page content or URLs have been disclosed.