lineshop[.]to

Analysis indicates that the domain lineshop.to was registered on 13 August 2025 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 91.206.71.115, which belongs to Cloudflare’s network (ASN 13335) and is geolocated in the Netherlands. The authoritative nameservers cody.ns.cloudflare.com and jamie.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. An HTTPS service is present; the certificate is issued by Google Trust Services under the WE1 root, showing a valid TLS chain but offering no indication of legitimacy. HTTP requests return a 200 status code and the only observed page title is the Russian phrase “Вы не робот?” suggesting the presence of a captcha or verification prompt, but the page content has not been publicly disclosed.

Reputation signals are strongly negative. Gridinsoft assigns a trust score of 0 out of 100, effectively flagging the site as completely untrusted. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans show that 2 out of 95 security vendors have flagged the domain, confirming that at least a minority of scanners consider it malicious. The overall risk rating is high and the status remains active as of 24 July 2026.

Uncertainties remain regarding the exact phishing campaign vector, the targeted brand, and the payload delivered after the initial page. No additional intelligence such as Safe Browsing, OTX, or detailed malware analysis is currently available. Defenders should block DNS resolution for lineshop.to, add the IP 91.206.71.115 to network‑level deny lists, and monitor for any outbound connections to Cloudflare‑hosted services that reference this domain. Continuous re‑scanning with multi‑vendor services is advised to capture any emerging detections.