voting-linea[.]xyz

Analysis of voting-linea.xyz shows that the domain was registered on 21 February 2026 and is currently offline. The site presented a page titled “Linea Rewards Update” and claimed to impersonate Google, consistent with the reported tech‑support scam classification. The domain resolves to 104.21.9.74, an address owned by Cloudflare, Inc. (AS13335) located in the United States. TLS inspection reveals a certificate identified as “WE1”, indicating the use of a generic or possibly compromised certificate rather than a Google‑issued chain.

VirusTotal scans returned 14 positive detections out of 93 participating scanners, confirming that multiple security vendors consider the site malicious. Independent blocklist feeds have added the domain to two separate blocklists, and it is actively listed by PhishDestroy and ScamSniffer, reinforcing the malicious reputation. No Safe Browsing or Open Threat Exchange entries are referenced in the available data, leaving those sources unverified for this indicator.

Because the site is already taken offline, immediate mitigation focuses on preventing future resolution attempts; defenders should add the domain and its IP address to local deny lists, enforce DNS‑level blocking, and monitor for any re‑registration attempts. Continued observation of Cloudflare‑associated IP ranges for similar patterns is recommended, as the infrastructure is commonly reused by threat actors. At present, the only concrete evidence consists of the page title, registration date, hosting details, SSL certificate label, vendor detection count, and blocklist listings; any additional behavioural characteristics of the payload or victim interaction remain unknown pending further investigation.