zeebu[.]airdropsalert[.]biz

This domain, zeebu.airdropsalert.biz, is identified as a brand impersonation phishing resource specifically targeting Gmail users. Analysis indicates the site mimics Google’s login interface, as evidenced by the page title 'Google,' with the intent to harvest credentials. No cryptocurrency drainer kit signatures were detected in initial scans, but the infrastructure aligns with credential theft campaigns. The domain does not appear to host additional payloads or exploit frameworks at this time, though further forensic analysis of offline artifacts may reveal secondary objectives such as malware distribution or session token hijacking.

Technical indicators confirm elevated risk: the domain is flagged by 15 out of 95 security vendors on VirusTotal, registered through Dynadot LLC on October 18, 2025, and resolves to the IP address 142.250.185.196, geolocated to the United States under AS15169 (Google LLC). Despite the IP association with a legitimate provider, the domain lacks an SSL certificate, a common red flag for phishing sites. It appears on one security blocklist and was proactively blocked by a threat intelligence feed. The creation date suggests recent deployment, likely timed to exploit current user awareness gaps around phishing lures. No Google Safe Browsing (GSB) detections were recorded prior to takedown, indicating either rapid evasion or limited exposure.

As of the latest assessment, zeebu.airdropsalert.biz has been taken offline, likely following detection and mitigation efforts. However, residual risk remains due to the domain’s recent registration and potential for re-deployment under altered infrastructure. Organizations and users are advised to monitor for related domains using similar naming conventions (e.g., 'airdropsalert') or registrant details. Immediate actions include revoking any credentials entered on the site, enabling multi-factor authentication for Gmail accounts, and scrutinizing network logs for connections to 142.250.185.196 during the active window. Security teams should treat this domain as part of a broader campaign and investigate associated email headers or phishing kits for lateral movement indicators.