linea[.]airdrpalert[.]click

The domain linea.airdrpalert.click is currently flagged as a credential phishing site that impersonates the Linea brand. The domain was registered through Dynadot LLC on October 30, 2025 and resolves to the IP address 142.251.32.100, which belongs to AS15169 Google LLC and is geographically located in the United States. Infrastructure analysis shows the domain is served from a Google-owned host but uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), indicating an attempt to obscure the true origin of the web service. No TLS certificate was observed, meaning the site was delivered over plain HTTP, which further reduces the trustworthiness of the connection.

The page title returned by the HTTP response is "Google," providing no indication of the intended brand and suggesting a generic placeholder rather than a targeted replica of the Linea login portal. VirusTotal scans have recorded detections by 10 of 95 security vendors, reinforcing the malicious classification. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service, confirming that defensive feeds have recognized it as malicious. The site is presently offline, limiting immediate exposure but indicating that the operators may reactivate the infrastructure in the future.

Defenders should continue to monitor the domain for any change in status, enforce blocklisting of the domain and its associated IP address, and update URL filtering rules to include the specific host. Because the registrar information is public, investigators may consider contacting Dynadot for additional registration data if needed. The lack of SSL and the generic page title are additional indicators that the site does not provide a legitimate user experience. Until the domain is confirmed inactive, security teams are advised to treat any traffic to linea.airdrpalert.