lineabuildairdrop2[.]pages[.]dev

Analysis of the domain lineabuildairdrop2.pages.dev shows a high‑risk crypto‑drainer campaign that was taken offline before the report date of July 24, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc., and the authoritative hosting is provided by Cloudflare’s network (ASN 13335) with the resolved address 104.21.32.1 located in the United States. No TLS certificate is presented, indicating the site operated without HTTPS. Google Safe Browsing flagged the URL for social engineering, and the scam type is identified as a fake airdrop, consistent with the page title “Linea: The home network for the world”.

VirusTotal scans returned ten positive detections out of ninety‑three vendors, confirming malicious intent. The IP address appears on a single security blocklist and the domain is currently blocked by the PhishDestroy mitigation service. The limited infrastructure footprint—single IP, single registrar—suggests a low‑cost deployment typical of opportunistic crypto‑drainer operations. Uncertainty remains regarding the exact payload delivered to victims, as no sample or sandbox analysis is available, and the site’s content has not been archived.

Defenders should update URL filtering to include this exact domain, enforce TLS‑only policies to prevent connections to non‑TLS sites, and monitor Cloudflare‑hosted IP ranges for similar patterns. Incident response teams should also consider correlating outbound traffic to 104.21.32.1 with potential unauthorized wallet interactions and block related network flows. Continuous threat‑intel feeds should be consulted for any re‑use of the same infrastructure, and affected users should be instructed to revoke compromised cryptocurrency credentials and audit wallet activity.