lineabuilder[.]xyz

Analysis of lineabuilder.xyz shows a newly registered domain created on October 20, 2025 that is actively masquerading as the Linea brand. The domain resolves to the Cloudflare‑owned address 172.67.159.117, which is associated with ASN 13335 and is geolocated in the United States. DNS resolution is handled by kim.ns.cloudflare.com and odin.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. Registration was performed through NameSilo, LLC, and no SSL certificate is presented, indicating that the site does not provide encrypted HTTPS connections.

The page title returned by the server is “Nur einen Moment…”, a phrase that does not reference the targeted brand and suggests that the content has been taken offline. Threat intelligence sources corroborate the malicious intent: AlienVault OTX lists the domain in a single pulse, and it appears on one external blocklist. VirusTotal scans report that nine of ninety‑five security vendors flag the domain, providing additional independent confirmation of suspicious activity. The domain has been identified by PhishDestroy and is currently listed as offline, which limits immediate exposure but does not remove the underlying infrastructure that could be re‑activated.

Defenders should continue to block the IP address 172.67.159.117 and the domain itself at the DNS level, monitor for any re‑registration or changes to the SSL status, and add lineabuilder.xyz to internal watchlists. Organizations using the Linea brand should educate users about the lack of a valid TLS certificate and the anomalous page title, and encourage verification of URLs before entering credentials. Ongoing surveillance of Cloudflare‑hosted assets linked to this domain is recommended to detect potential re‑deployment of the impersonation campaign.