lineaairdrop[.]pages[.]dev

Analysis of lineaairdrop.pages.dev was performed on July 24 2026 using available open‑source data. The domain resolves to the Cloudflare‑owned address 172.66.44.252 and is hosted behind AS13335 Cloudflare, Inc., with DNS served by janet.ns.cloudflare.com and jeff.ns.cloudflare.com. Registration occurred on February 21 2026 through Cloudflare, Inc., indicating a rapid deployment typical of disposable phishing infrastructure. The site presents a page title of "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, suggesting that the content is currently inaccessible but was previously reachable. The SSL certificate is issued by Google Trust Services under the WE1 designation, confirming that HTTPS termination is provided by Cloudflare’s edge network.

Security telemetry shows the domain appears on a single blocklist and has been flagged by the PhishDestroy blocking service. VirusTotal analysis records seven of ninety‑three scanners labeling the domain as malicious, reinforcing the suspicion of abusive activity. Additional technical markers include enforced HSTS and support for HTTP/3, both native to Cloudflare’s platform. Gridinsoft’s trust score of 0 out of 100 further reflects a lack of legitimacy.

The documented scam type is a "Fake Airdrop," aligning with the broader classification of a crypto drainer that seeks to harvest private keys or wallet credentials. While the exact payload or phishing page content has not been captured, the convergence of blocklist inclusion, multiple vendor detections, low trust scoring, and the fake‑airdrop label provides strong evidence of a malicious operation. Defenders are advised to add lineaairdrop.pages.dev to domain blocklists, monitor for any new DNS resolutions associated with the same IP range, and enforce endpoint protections that detect credential‑stealing attempts targeting cryptocurrency wallets.