lineaform[.]org

Analysis as of July 22 2026 indicates that the domain lineaform.org is associated with a brand‑impersonation campaign targeting the cryptocurrency project Linea. The domain was registered on 1 October 2025 through NameSilo, LLC and is delegated to Cloudflare’s authoritative nameservers damon.ns.cloudflare.com and mary.ns.cloudflare.com. DNS resolution points to the IP address 172.67.194.91, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. No TLS certificate was observed for the host, implying that HTTPS was not provisioned at the time of capture.

Passive scanning on VirusTotal shows that two of ninety‑five AV engines flagged the domain as malicious, and the domain is listed on at least one public phishing blocklist. PhishDestroy has also taken the domain offline, and current network checks confirm that the site is no longer reachable. The only visible page element captured before takedown was the title “Nur einen Moment…”, which does not contain the brand name but is consistent with a generic waiting page often used in phishing redirects. The combination of a newly created domain, Cloudflare hosting, absence of a valid SSL certificate, and detection by multiple security vendors aligns with typical infrastructure used for brand‑impersonation scams.

Defenders should continue to block traffic to 172.67.194.91 and add lineaform.org to URL filtering policies. Organizations monitoring for Linea‑related threats should also watch for future domains registered with similar naming patterns or hosting on the same Cloudflare ASN. Because the site is currently offline, immediate damage assessment is limited, but the observed indicators warrant inclusion in threat‑intel feeds and ongoing vigilance.