lineal2-network[.]xyz

lineal2-network.xyz was observed resolving to the Cloudflare edge address 104.21.82.175, which is announced by AS13335 in the United States. The domain was registered on 28 September 2025 through NiceNIC International Group Co., Limited and is served by the Cloudflare nameservers julissa.ns.cloudflare.com and tony.ns.cloudflare.com. No TLS certificate was presented during the brief connection attempt, and the HTTP response returned the generic title “Just a moment…”. VirusTotal records indicate that two of ninety‑five scanning engines flagged the domain as malicious, and the site appears on a single external blocklist.

PhishDestroy has also listed the domain as blocked. The infrastructure is classified as a brand‑impersonation campaign targeting the blockchain platform Linea, as indicated by the intelligence tag “Impersonates: Linea” and the scam type “Brand Impersonation”. The domain is currently reported as offline, which limits real‑time verification of the payload or credential‑harvesting mechanisms that may have been hosted. Consequently, the exact malicious content, redirect chains, or credential‑capture pages remain unknown.

Analysts should treat the domain as a potential threat vector until further evidence confirms its decommissioning. Defensive actions include adding the IP address 104.21.82.175 and the domain lineal2-network.xyz to network‑level deny lists, enforcing DNS filtering for the domain, and monitoring for any resurgence of the hostname or related Cloudflare‑hosted subdomains. Continuous observation of VirusTotal, blocklist feeds, and threat‑intelligence platforms is recommended to capture any future re‑activation. Because the registrar is NiceNIC International Group, investigators may consider requesting registration data to corroborate ownership and assess whether the domain is part of a broader malicious infrastructure.