airdrop[.]etherex[.]net

Analysis of airdrop.etherex.net, observed on July 24, 2026, shows a short‑lived infrastructure used for a brand‑impersonation campaign targeting the Linea ecosystem. The domain was registered on February 21, 2026 through Spaceship, Inc., and resolves to the IP address 66.29.148.78, which is hosted by Namecheap, Inc. (AS22612) in the United States. The site presented the page title "Etherex | Docs," a title that does not reference the targeted brand and suggests a generic documentation page. The SSL certificate associated with the domain is identified as R11, indicating a standard TLS certificate without extended validation.

Nameservers launch1.spaceship.net and launch2.spaceship.net confirm the registrar’s involvement. Reputation metrics are extremely low: Scamadviser assigns a trust score of 26 / 100, while Gridinsoft rates it 0 / 100, reflecting a high likelihood of malicious intent. The domain appears on two independent blocklists—PhishDestroy and ScamSniffer—further corroborating its classification as a crypto‑related scam. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, confirming that at least one security vendor has flagged the host as suspicious.

The site is currently offline, and no additional content has been captured, leaving the exact phishing page structure and any credential‑harvesting mechanisms unverified. Defenders should proactively block the domain and its resolving IP, add the observed nameservers to watchlists, and monitor for any resurgence of similar subdomains under the same registrar. Continuous tracking of the associated ASN and periodic re‑scans of the IP are recommended to detect potential re‑use of the hosting infrastructure for future impersonation attempts.