linea-spin[.]net

This domain operates as a fraudulent Linea rewards portal designed to harvest cryptocurrency wallet credentials and private keys. The site presents itself as an official "Linea Hub | Rewards" platform, exploiting the Linea brand to trick users into connecting their wallets through deceptive airdrop or reward claims. Analysis of the infrastructure reveals technical elements commonly associated with credential theft operations, including the use of Cloudflare for hosting and Vue.js for dynamic content rendering, which may facilitate real-time credential interception. Evidence confirms the malicious nature of linea-spin.net through multiple technical indicators. The domain is flagged by 14 out of 95 security vendors on VirusTotal, appears on three independent security blocklists, and is blocked by major wallet security systems. Registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 188.114.96.3 and employs additional technologies such as Contentful for content management and Cloudflare Browser Insights for user tracking. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk threat. Users who interacted with linea-spin.net should immediately revoke any wallet permissions granted to the site and transfer assets to a new, secure wallet. All connected devices should undergo a full malware scan using updated security tools to detect potential secondary infections. Any credentials entered on the site must be considered compromised and changed across all platforms where they were reused. Monitoring for unauthorized transactions is critical, and affected users should report the incident to relevant blockchain security teams for further analysis and potential mitigation measures.