linea[.]airsdropsalert[.]lol

On July 24, 2026, analysts examined the domain linea.airsdropsalert.lol, which was identified as a credential‑phishing site impersonating the Linea brand. The domain was registered on 5 November 2025 through Dynadot LLC and is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to the address 172.253.62.99, an IP owned by Google LLC (AS15169) located in the United States. No TLS certificate was observed for the host, indicating that the site was delivered over plain HTTP. The page title returned by the server was “Google”, providing no direct reference to the targeted brand.

VirusTotal scans recorded eight detections out of ninety‑five participating security vendors, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline, and current probing confirms that the host no longer responds. The available evidence confirms that the infrastructure was deliberately crafted to mimic Linea‑related communications, likely to harvest user credentials. However, the lack of a visible brand name in the page title and the absence of SSL limit the immediate attribution of a specific phishing kit.

Further analysis of any archived HTTP payloads or redirects would be required to determine whether the site displayed a login facade or collected data via third‑party services. Defenders should continue to monitor the IP range 172.253.62.99 for any new host registrations that reuse the same Cloudflare nameservers, and ensure that URL filtering solutions block both the exact domain and any sub‑domains under the “airsdropsalert.lol” suffix. Organizations using the Linea brand should advise users to verify URLs carefully and to report any unexpected requests for credentials to their security teams.