linea-hub[.]web[.]app

This domain, linea-hub.web.app, operates as a credential-harvesting phishing site targeting users of Linea, a blockchain platform. The site presents a counterfeit login interface designed to mimic legitimate wallet authentication portals, tricking users into submitting sensitive credentials such as private keys, recovery phrases, or wallet passwords. Given the irreversible nature of blockchain transactions, compromised credentials could lead to immediate and total asset loss, making this a high-impact threat vector for cryptocurrency users. Analysis indicates the domain was hosted on Google Firebase infrastructure and employed multiple modern web technologies, including HTTP/3 and HSTS, to appear legitimate. The SSL certificate was issued by Google Trust Services, a common tactic used to evade initial suspicion. At the time of assessment, the domain resolved to IP address 142.251.15.106. Security vendor analysis via VirusTotal revealed that 8 out of 95 engines flagged the domain as malicious, while it appeared on at least one security blocklist. The page title was set to 'Google,' further suggesting an attempt to deceive users into believing they were interacting with a trusted authentication flow. Users who visited linea-hub.web.app and entered credentials are advised to immediately cease all interaction with the site. Affected individuals should transfer any assets from the compromised wallet to a new, secure wallet with a fresh recovery phrase. All devices used to access the site should undergo a full malware scan using updated security tools. Additionally, users should monitor all linked accounts for unauthorized activity and enable multi-factor authentication where available. Given the offline status of the domain, no further credential submission is possible, but previously harvested data may still be exploited by threat actors.