lineacast[.]org

This domain, lineacast.org, is flagged as an elevated-risk brand impersonation threat targeting Linea, a known blockchain platform. Infrastructure analysis reveals the domain was registered on September 30, 2025, through NameSilo, LLC, and is currently offline. It resolves to the IP address 172.67.180.4, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of phishing infrastructure. The domain uses Cloudflare nameservers (kim.ns.cloudflare.com and odin.ns.cloudflare.com), and no SSL certificate was detected, increasing the likelihood of insecure connections.

Detection data indicates the domain appears on at least one security blocklist (PhishDestroy), and one of 95 security vendors on VirusTotal flagged it as malicious. The page title 'Un instant…' suggests a temporary or interstitial page, which is often used in phishing campaigns to delay or redirect victims. While the exact content of the site is not analysed, the available evidence—including the brand target (Linea), registration details, and detection status—aligns with known brand impersonation tactics. Defenders should treat this domain as compromised and avoid any interaction.

The use of Cloudflare hosting and the absence of SSL further reduce transparency, making it difficult to trace the true operators. Given its current offline status, monitoring for reactivation or related domains with similar infrastructure is recommended. If encountered, the domain should be blocked at the network level, and any associated credentials or transactions should be considered compromised.