linea[.]airdropsalert[.]xyz

Analysis indicates that the domain linea.airdropsalert.xyz was registered on October 17, 2025 through Dynadot LLC and is currently resolved to the IP address 142.250.186.132, which belongs to Google LLC (AS15169) in the United States. The domain is hosted on Cloudflare infrastructure, as reflected by its authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL certificate is presented, meaning the site does not support HTTPS and any traffic would be transmitted over cleartext HTTP. The page title returned by the web server is "Google," a generic label that does not correspond to the targeted brand.

The domain is classified as a crypto‑scam that impersonates the Linea blockchain platform, as indicated by the brand target and scam type fields. VirusTotal scans have flagged the domain in 14 of 95 security vendor engines, providing modest but notable malicious confidence. PhishDestroy has already blocked the domain, and it appears on one external security blocklist. The domain is presently taken offline, limiting immediate exposure, but the infrastructure (Google IP, Cloudflare DNS) suggests the operators leveraged reputable services to increase perceived legitimacy.

Uncertainty remains regarding the specific payload or phishing pages, as the site content has not been captured and the page title alone offers no functional insight. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the domain to threat‑intel feeds. Ongoing observation of the associated IP range and Cloudflare nameservers is advised, as they may host additional malicious actors.