criptodinero-en-linea[.]blogspot[.]com

criptodinero-en-linea.blogspot.com is currently active and hosts a page titled "Cripto dinero en Linea". The site is classified as a brand‑impersonation campaign targeting the Linea brand. Google Safe Browsing has flagged the URL for social engineering, and multiple security vendors (11 of 95) have marked the domain as malicious, confirming a high‑risk rating. The page title and the listed brand target indicate that the operator is attempting to lure victims by suggesting a cryptocurrency‑related service associated with Linea.

Technical infrastructure shows the domain is a Blogger sub‑domain registered through MarkMonitor, Inc. It resolves to IP 142.250.186.65, which belongs to AS15169 Google LLC and is geolocated in Germany. The site serves traffic over HTTPS using a certificate issued by Google Trust Services (WE2), and the connection negotiates HTTP/3. Detected technologies include Blogger, Java, Python, OpenGSE, jsDelivr, Google AdSense, and standard Google name servers (ns1‑ns4.google.com). Reputation services assign extremely low trust scores (Gridinsoft 0/100, Scamadviser 1/100). The domain appears on one public blocklist and is already blocked by PhishDestroy.

Defenders should immediately add criptodinero-en-linea.blogspot.com to URL filtering and DNS blocklists, and consider blocking the associated IP address 142.250.186.65 as a precaution, noting that the IP is shared with legitimate Google services. Continuous monitoring of newly created Blogger sub‑domains that reference "Linea" or cryptocurrency terms is advisable, as the attacker may replicate this approach on other Google‑hosted sites. Organizations should educate users about unsolicited links promising crypto earnings and reinforce the policy of verifying URLs against official Linea channels. Incident response teams should collect any HTTP request logs that reference this domain for correlation with credential‑theft attempts.