linea[.]wiki

This domain, linea.wiki, presents a high-risk brand impersonation threat specifically targeting users of the Across protocol, a cross-chain bridge platform. The site mimics legitimate Across interfaces, likely to deceive users into connecting wallets or approving malicious transactions. The primary attack vector appears to be crypto asset theft through fraudulent transaction prompts or smart contract interactions, potentially leading to unauthorized fund transfers or token approvals to attacker-controlled addresses. The domain's infrastructure and content are designed to exploit trust in the Across brand, increasing the likelihood of successful social engineering attacks against cryptocurrency users seeking bridge services. Analysis of technical indicators reveals multiple red flags. The domain was registered on August 27, 2025, through NameCheap, Inc., with an unusually recent creation date suggesting a short-lived malicious campaign. VirusTotal detection shows 15 out of 95 security vendors flagging the domain as malicious, including classifications for phishing and brand impersonation. The domain appears on three independent security blocklists and is actively blocked by wallet security extensions and domain reputation services. Infrastructure analysis reveals the domain resolves to 104.21.86.20, hosted on Cloudflare's network (AS13335), with an SSL certificate issued by Google Trust Services. The page title, 'Home | Meteora,' further indicates potential impersonation of multiple crypto platforms, suggesting either a multi-brand phishing operation or a misconfiguration in the attacker's infrastructure. Users who have visited linea.wiki should immediately take protective measures. Any wallet connections or transaction approvals made on this domain should be considered compromised. Users should revoke all token approvals associated with the domain using a blockchain explorer or dedicated revocation tool. Connected wallets should be audited for unauthorized transactions, particularly those involving token transfers or contract interactions. It is recommended to monitor accounts for suspicious activity and consider migrating funds to a new wallet if any interaction with the domain occurred. The domain's active status and recent registration suggest ongoing malicious activity, warranting immediate action from potentially exposed users. Network-level blocking of the domain and associated IP address is advised for organizations and security-conscious individuals.