airdrop-lineabulid[.]xyz

On July 24, 2026, the domain airdrop-lineabulid.xyz was assessed and classified as a brand‑impersonation site targeting the blockchain platform Linea. The domain was registered on September 10, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IP address 104.21.112.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was presented, indicating that the site was served over plain HTTP. The page title returned by the server is “Un momento…”, which provides no additional context about the malicious content. Security telemetry shows that the domain is listed on the PhishDestroy blocklist and appears on one additional public blocklist.

VirusTotal scans reported that 9 of 95 antivirus and URL‑reputation engines flagged the domain as malicious, reinforcing the suspicion of abuse. Independent reputation services assign very low trust scores: Gridinsoft reports a score of 0 out of 100, while Scamadviser assigns a confidence rating of 40 out of 100. These metrics, combined with the observed blocklist presence, suggest a high likelihood of malicious intent. The observed activity aligns with a crypto‑scam pattern, as indicated by the supplied “Scam type: Crypto Scam” label. The domain’s impersonation of Linea is explicitly noted, but no further technical artifacts such as malicious payloads, credential‑harvesting forms, or redirects have been captured at the time of analysis.

Consequently, the precise attack vector remains uncertain. Defenders should block DNS resolution for airdrop-lineabulid.xyz at the network perimeter and add the associated IP address 104.21.112.1 to any relevant deny lists, keeping in mind that the IP is shared across many Cloudflare customers. Monitoring of outbound traffic to this address for anomalous connections is advised. Because the site currently reports an offline status, continuous re‑evaluation is recommended in case the infrastructure is re‑activated.