linea[.]airdropsalert[.]us

The domain linea.airdropsalert.us was registered through Dynadot LLC on 18 October 2025 and currently resolves to the IP address 142.251.163.99, which belongs to AS15169 Google LLC located in the United States. The domain is hosted on Cloudflare name servers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) but does not present an SSL/TLS certificate, indicating that any HTTP communication would be unsecured. Google Safe Browsing has flagged the site for social engineering, and the public blocklist PhishDestroy confirms the domain as malicious. VirusTotal analysis shows that 12 out of 93 scanning engines have raised detections against the domain, reinforcing the suspicion of abuse.

The site is listed on a single security blocklist and receives the lowest possible Gridinsoft trust score (0/100). The page title returned from the live host is the generic string “Google”, providing no insight into the actual content that was served before the site was taken offline. The threat profile is identified as a crypto‑related scam that impersonates the Linea blockchain brand, as indicated by the “Brand target: Linea” and “Scam type: Crypto Scam” entries.

Because the infrastructure points to a legitimate cloud provider (Google) but is leveraged by a malicious actor, attribution to a specific campaign is not possible at this stage. Defenders should immediately add linea.airdropsalert.us to blocklists, monitor DNS queries for the domain, and enforce outbound filtering for the associated IP address. Continuous re‑evaluation is advised in case the domain is re‑activated or new indicators surface.