claim[.]linea-guild[.]org

On 24 July 2026, claim.linea-guild.org was observed hosting a page titled “Nur einen Moment…”. The domain is registered through NameSilo, LLC and was created on 2 October 2025. DNS resolution points to the IP address 104.21.73.232, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Authoritative nameservers are damon.ns.cloudflare.com and mary.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service.

No TLS certificate is presented for the host, and the site currently returns an offline HTTP status, suggesting that the content has been taken down or is no longer reachable. The site is classified as a brand‑impersonation campaign targeting the Linea brand and is associated with a crypto‑scam motive. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service.

VirusTotal analysis, performed by 95 scanning engines, reported no detections at the time of the scan; however, the absence of detections does not constitute confirmation of safety. Given the combination of a newly created domain, use of Cloudflare infrastructure, lack of encryption, low trust score, and inclusion on blocklists, the indicator should be treated as malicious. Defensive teams are advised to add claim.linea-guild.org to deny‑list rules at DNS, proxy, and endpoint layers, monitor for any future re‑registration or related sub‑domains, and consider sharing the indicator with threat‑intel sharing platforms. Continuous observation is recommended to detect any resurgence of activity, especially because the risk level remains under investigation.