linea[.]airsdropsalerts[.]sbs

The domain linea.airsdropsalerts.sbs was registered on November 07, 2025 through Dynadot LLC and is currently marked as taken offline. DNS resolution points to IP address 142.250.185.100, an address owned by Google LLC (AS15169) located in the United States. The domain is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, yet no TLS certificate is presented for the host, indicating that HTTPS is not configured. HTTP requests return a page whose title is simply "Google," providing no further contextual clues about the content served.

The site is classified as a credential phishing operation that impersonates the Linea brand, matching the supplied brand target. Detection services have identified the domain on one security blocklist, and PhishDestroy has explicitly blocked it. VirusTotal analysis shows that 12 of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment.

Although the site appears to have been removed from public access, the underlying infrastructure—Google‑owned IP and Cloudflare DNS—remains observable and could be reused for future campaigns. Defenders should continue to block the domain at the DNS and network layers, add the associated IP address to deny lists, and monitor for any re‑registration attempts or similar sub‑domains that target the Linea brand. Ongoing vigilance is advised, especially given the lack of SSL and the minimal visible content, which hampers deeper forensic analysis of the payload delivered to victims.