linea[.]airdropsalert[.]biz

This domain, linea.airdropsalert.biz, was registered on 18 Oct 2025 through Dynadot LLC and is currently taken offline. The domain is configured to use Cloudflare nameservers (bre... and hassan.ns.cloudflare.com) and resolves to the IP address 142.250.186.164, which is owned by Google LLC (AS15169) in the United States. No TLS certificate was observed for the host, indicating that HTTPS was not enabled despite the presence of Cloudflare DNS.

The HTTP service returned an offline status, and the sole page title retrieved was "Google", which does not correspond to the targeted brand. The site is classified as a crypto‑scam that impersonates the Linea blockchain platform. Infrastructure indicators show that the domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that 16 of 95 scanning engines label the domain as malicious.

These detections collectively suggest a high‑confidence malicious intent aimed at deceiving users of the Linea ecosystem. Because the site is no longer reachable, direct content analysis is limited; however, the combination of brand impersonation, lack of TLS, Cloudflare‑based hosting, and multiple vendor detections provides sufficient evidence for defensive action. Organizations should add linea.airdropsalert.biz to URL filtering and DNS sinkhole rules, monitor for any future re‑activation, and enforce strict brand‑specific browsing controls for Linea‑related services. Continuous telemetry from endpoint and network security tools should be used to detect any attempts to contact the domain or its associated IP, and any related indicators of compromise should be shared with threat‑intelligence platforms.