linea[.]airdropsalerts[.]sbs

linea.airdropsalerts.sbs is a newly registered domain (created 24 Oct 2025) that purports to target users of the Linea blockchain platform. The site’s HTML title resolves to “Google”, a tactic often used to obscure the malicious intent of the page. The domain was registered through Dynadot LLC and is hosted on an IP address (192.178.218.104) owned by Google LLC (ASN15169) in the United States. It is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but it does not present an SSL certificate, exposing any HTTP traffic to interception.

VirusTotal scans have flagged the domain in 14 of 95 antivirus engines, and the domain appears on at least one external security blocklist, specifically PhishDestroy, which has already taken the site offline. The listed scam type is “Crypto Scam”, and the threat actor explicitly impersonates the Linea brand. Although the site is currently offline, the underlying infrastructure—Google‑owned IP and Cloudflare DNS—could be reused for future campaigns. Defenders should add the domain to internal blocklists, monitor the associated IP for any new hostnames, and consider sinkholing requests to the IP.

Continuous verification of Cloudflare‑hosted subdomains that reference “linea” or “airdropsalerts” is advised, as the attacker may spin up new variants. Logging of TLS‑less HTTP requests to this IP can provide early warning of re‑activation. Integration of the VirusTotal detection count and the PhishDestroy blocklist entry into SIEM correlation rules will improve detection of similar brand‑impersonation attempts.