linea-agent[.]vercel[.]app

This domain, linea-agent.vercel.app, is flagged as a high-risk brand impersonation threat targeting Linea, a blockchain platform. Analysis indicates the site mimics Linea's branding under the guise of a 'Linea AI Agent,' likely designed to deceive users into disclosing sensitive credentials or interacting with malicious smart contracts. The threat type is classified as brand impersonation, with no direct evidence of a crypto drainer kit at this stage, though further investigation is warranted given the domain's deceptive nature. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure and resolves to IP address 64.29.17.67, located in the US under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by Google Trust Services (WR1), a common provider for both legitimate and malicious domains. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, while it appears on one additional security blocklist. The domain remains active, with no public record of its creation date, limiting temporal analysis. Google Safe Browsing (GSB) status is not explicitly provided, but the presence on PhishDestroy’s blocklist suggests confirmed malicious activity. Current status indicates the domain is still active, posing an ongoing risk to users. Response actions should include immediate blacklisting in enterprise security controls, DNS sinkholing, and endpoint protection updates to block resolution. Users are advised to verify domain authenticity before interaction, particularly when prompted for credentials or wallet connections. Given the domain’s persistence and brand impersonation tactics, organizations should monitor for related phishing campaigns and educate users on identifying deceptive blockchain-related sites. The risk remains high due to the domain’s active status and targeted impersonation of a trusted brand.