register-lineabuild[.]xyz

The domain register-lineabuild.xyz was registered through NiceNIC International Group Co., Limited and created on February 24, 2026. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which is hosted in the United States under ASN 13335 owned by Cloudflare, Inc. The domain is currently taken offline, but historical DNS records indicate it used Cloudflare’s authoritative nameservers clay.ns.cloudflare.com and heather.ns.cloudflare.com. No SSL certificate was observed for the host, meaning HTTPS connections were not established at the time of analysis.

The page title returned by the HTTP response was "Linea: The home network for the world," directly referencing the targeted brand Linea. This aligns with the classified scam type of brand impersonation, where the malicious actor attempts to masquerade as the legitimate Linea service. The domain appears on five security blocklists and has been flagged by the vendors PhishDestroy, MetaMask, ScamSniffer, SEAL, and Enkrypt, indicating a consensus among multiple threat intelligence sources that the site is malicious.

VirusTotal scans recorded three out of ninety‑three security vendors flagging the domain, providing additional corroboration of its risk profile. Given the observed indicators—registration details, hosting under Cloudflare, lack of TLS, brand‑specific page title, blocklist presence, and vendor detections—defenders should add register-lineabuild.xyz to deny‑list rules, monitor for any re‑activation of the domain, and watch for similarly structured domains that target the Linea brand. Continuous observation of the NiceNIC registrar for new registrations resembling the brand name is also recommended to pre‑empt further impersonation attempts.