linearoll[.]org

Analysis as of 25 July 2026 shows that linearoll.org resolves to the Cloudflare address 172.67.168.8, which is advertised as being located in the United States under ASN 13335 owned by Cloudflare, Inc. The domain was registered on 27 September 2025 through NameSilo, LLC and uses the Cloudflare nameservers damon.ns.cloudflare.com and mary.ns.cloudflare.com. No TLS certificate is presented, indicating that HTTPS is not configured for the site. The only visible HTML element captured by crawlers is the page title “Nur einen Moment…”, which does not provide functional content but confirms that the site is reachable. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment that it is being used for malicious purposes.

The threat profile identifies the site as a brand‑impersonation campaign targeting the Linea brand. VirusTotal analysis recorded a single positive detection out of ninety‑five scanners, suggesting that at least one security product recognized malicious characteristics. Because the site is currently offline, active probing is limited, and the exact payload or credential‑capture mechanism remains unknown. No additional intelligence such as malicious scripts, phishing kits, or command‑and‑control infrastructure has been disclosed.

Defenders should update URL filtering rules to include linearoll.org in blocklists and enforce TLS inspection policies to catch any future attempts to serve content over HTTPS. Monitoring of the associated IP address 172.67.168.8 for new hostnames or traffic spikes is advisable, given its presence in a shared Cloudflare pool. Organizations that rely on Linea services should educate users about unsolicited requests that reference the brand and encourage verification through official channels. Continuous re‑assessment of the domain’s status is recommended, as the offline condition may change if the operators reactivate the site.