servicios-en-linea[.]com

The domain servicios-en-linea.com was registered on February 21, 2026 through Atak Domain Bilgi Teknolojileri A.S. and is currently active. DNS resolution points to IP address 198.58.112.19, which belongs to the Akamai Connected Cloud network (AS63949) and is geolocated in the United States. The site presents a Let's Encrypt R12 certificate, confirming the use of a free TLS service, and the web server stack includes PHP running on LiteSpeed with HTTP/3 support.

An HTTP request returns a 403 status code, indicating that direct access is denied or restricted. The page title returned by the server is "servicios-en-linea.com/," which does not reveal any additional content. VirusTotal analysis shows that 12 of 93 security vendors have flagged the domain as malicious, reinforcing the suspicion of abuse. The domain appears on three external blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL, all of which categorize it as a brand impersonation targeting the Linea brand.

While the limited public surface prevents a full content assessment, the combination of recent registration, use of a reputable CDN, a free SSL certificate, and multiple vendor detections suggests a deliberate attempt to exploit the Linea brand. Defenders should add the domain to internal deny lists, monitor traffic to the associated IP range, and consider enforcing strict outbound filtering for connections to services hosted on LiteSpeed with PHP. Continuous re‑evaluation is advised, as the threat actor may modify the site to serve malicious payloads or credential‑harvesting pages in the future.