onlinealpinebk[.]icu

This domain onlinealpinebk.icu is currently active and serves a page whose HTML title is “Just a moment…”. The site is hosted behind Cloudflare and resolves to the IP address 188.114.96.3, which is registered to Cloudflare, Inc. in Canada. DNS resolution uses the Cloudflare nameservers chuck.ns.cloudflare.com and jule.ns.cloudflare.com, indicating that the attacker is leveraging Cloudflare’s CDN and DDoS‑mitigation services. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming that the connection is encrypted but does not authenticate the underlying content. Registration data shows the domain was created through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is listed on at least one public blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scans show that six of ninety‑one security vendors flagged the domain, and AlienVault OTX reports the indicator in two separate threat‑intel pulses, reinforcing the assessment of malicious intent. The HTTP response code is 403, which may be used to present a Cloudflare challenge page rather than a traditional login portal. The campaign is classified as brand impersonation targeting the Linea brand. No additional payload or credential‑ harvesting infrastructure has been observed, and the exact phishing landing page content remains unverified. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated Cloudflare nameservers, and consider adding the IP address 188.114.96.3 to deny lists. Ongoing observation is recommended to detect any evolution of the infrastructure or emergence of new malicious endpoints.