lineafunds[.]org

Analysis of lineafunds.org shows a domain registered on September 18, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and hosted on Cloudflare infrastructure (AS13335). The domain resolves to the IP address 104.21.89.153, which is located in the United States and served by Cloudflare’s edge network. DNS resolution uses the Cloudflare authoritative name servers kim.ns.cloudflare.com and odin.ns.cloudflare.com. No TLS certificate is presented for the site, indicating that HTTPS was not configured at the time of observation.

The page title returned by the web server is "Cierpliwości...", which does not contain any reference to the target brand. The domain is listed on a single public blocklist, with PhishDestroy reporting it as malicious, and it receives a Gridinsoft trust score of 0 out of 100. VirusTotal has scanned the domain with 95 antivirus engines and reported no detections, a result that should not be interpreted as evidence of safety. The only explicit indicator of malicious intent is the classification as a brand‑impersonation campaign targeting the Linea brand.

The site’s current status is offline, suggesting that the operator may have withdrawn the infrastructure or is in the process of re‑deployment. The evidence confirms that lineafunds.org has been used in an impersonation attempt, but the lack of an active payload, SSL, or additional forensic artifacts limits the ability to attribute a specific phishing kit or to assess the scale of the campaign. Defenders should continue to block the domain at network perimeter devices, monitor for any re‑appearance of the same host name or IP address, and update detection rules to flag traffic to the Cloudflare IP range originating from suspicious client contexts.