linea[.]airdropsalert[.]app

On July 23, 2026, the domain linea.airdropsalert.app was observed to host a crypto‑scam campaign that impersonates the Linea blockchain platform. The site resolves to the IP address 142.251.40.164, which belongs to Google LLC (AS15169) in the United States. Registration details show the domain is provisioned through Cloudflare, Inc., and no TLS certificate was presented during the scan, indicating an unencrypted HTTP service. Google Safe Browsing classifies the domain as a social‑engineering threat, and it appears on one external security blocklist.

VirusTotal recorded 15 detections out of 95 scanned security vendors, confirming that multiple tools consider the domain malicious. PhishDestroy also lists the domain as blocked. The HTTP response returned a generic page title of “Google,” providing no legitimate branding cues. The current operational status is offline, which limits live interaction but does not remove the underlying infrastructure from threat‑intel repositories.

Defenders should continue to block the domain at network perimeter, include the associated IP address in deny lists, and monitor for any re‑hosting attempts that may reuse the same IP range or Cloudflare account. Because the site lacks a valid SSL certificate, any future activation would be trivially detectable by the absence of HTTPS. Continuous observation of Cloudflare‑hosted assets targeting the Linea brand is recommended to catch similar replications early.