linea[.]buliid[.]com

Analysis indicates that linea.buliid.com is an active phishing domain impersonating Linea, a blockchain network. The domain was registered on September 10, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IP address 104.21.8.188. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3, and an SSL certificate issued by Google Trust Services, which aligns with tactics commonly observed in phishing campaigns to evade detection and appear legitimate. The page title 'Just a moment...' suggests the domain may be employing anti-bot or redirect mechanisms, a technique frequently used to obscure malicious content from automated security scans. As of July 12, 2026, the domain remains active and has been flagged by 8 of 95 security vendors in a recent scan, though the specific nature of the detections is not detailed. It also appears on at least one security blocklist, further corroborating its malicious classification. The exact content or functionality of the site has not yet been analyzed, but the domain is explicitly categorized as brand impersonation targeting Linea. Defenders should treat this domain as high-risk infrastructure and consider blocking or monitoring access to it. Given the use of Cloudflare and the domain's recent registration, additional obfuscation or evasion techniques may be in place. No evidence of a phishing kit or specific attack vector (e.g., credential harvesting, crypto drainer) is currently available, but the domain's infrastructure supports the likelihood of malicious activity.