linea[.]airdrpsalert[.]life

On July 23, 2026, the domain linea.airdrpsalert.life was observed as an offline credential‑phishing infrastructure targeting the Linea brand. DNS resolution points the domain to 172.67.182.158, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The domain was registered through Cloudflare, Inc., and the authoritative nameserver information could not be retrieved (NS_NOT_FOUND). No TLS certificate was presented, and HTTP requests return a 502 Bad gateway error, as reflected in the page title “airdrpsalert.life | 502: Bad gateway”. Analysis of the payload indicates the use of an “Airdrop Scam” phishing kit, a common template for cryptocurrency‑related credential harvesting.

VirusTotal has logged 12 detections out of 95 scanned engines, confirming that a subset of security vendors consider the domain malicious. Independent scoring services also flag the site as highly untrustworthy, with Gridinsoft assigning a trust score of 0 / 100. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. The risk rating is elevated, reflecting the combination of confirmed malicious detections, low trust score, and the targeted brand impersonation. Uncertainty remains regarding the exact content hosted before takedown; the 502 response prevents retrieval of any landing page, and no SSL certificate or additional metadata were captured.

The lack of visible nameserver records limits attribution of any secondary hosting infrastructure. Defenders should add linea.airdrpsalert.life to existing URL blocklists, monitor DNS queries for the resolved IP address 172.67.182.158 for possible reuse, and enforce credential‑validation controls for services associated with the Linea brand. Continuous threat‑intel feeds should be consulted for any re‑registration attempts, and endpoint protection solutions should be updated to include the observed VirusTotal signatures.