chaseonlineacces[.]github[.]io

This domain, chaseonlineacces.github.io, is actively engaged in brand impersonation targeting Linea, a recognized blockchain platform. Analysis confirms the domain is currently active and designed to deceive users into believing they are interacting with legitimate Linea infrastructure. The threat type is specifically categorized as brand impersonation, not generic phishing or credential theft, due to its targeted misuse of Linea’s branding elements and user interface. Infrastructure analysis reveals the domain is registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, located in the United States. The domain appears on one security blocklist and has been flagged by 16 of 95 vendors on VirusTotal, indicating a moderate to high level of detection. The SSL certificate is issued by Let’s Encrypt (R12), a common but not inherently malicious certificate authority. The page title, 'Site not found · GitHub Pages,' suggests either an attempt to evade detection or a placeholder status while the malicious infrastructure is prepared or rotated. Current status indicates the domain remains active and poses a significant risk to users unfamiliar with Linea’s legitimate domains. The use of GitHub Pages for hosting malicious content is a known tactic to exploit trusted cloud infrastructure. Organizations and individuals are advised to block this domain at the network level and monitor for related subdomains or IPs. Users should verify the authenticity of any Linea-related communications by cross-referencing official channels. Security teams are encouraged to review logs for connections to 185.199.108.153 and investigate any associated user reports of unauthorized transactions or account access attempts.