llinea-drop[.]com

Analysis of llinea-drop.com shows that the domain was registered on 21 February 2026 and is currently taken offline. DNS resolution points to IP 104.21.72.214, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title “Nur einen Moment…”, a phrase that does not disclose any further content. An SSL certificate labeled WE1 was observed, indicating that HTTPS was enabled at the time of capture.

The domain is listed on a single security blocklist and is explicitly flagged by PhishDestroy. VirusTotal scans returned three positive detections out of ninety‑three scanners, confirming that multiple security products identified malicious characteristics. The campaign is classified as a brand‑impersonation operation targeting the Linea brand, consistent with the supplied “Brand target” field. No additional infrastructure such as secondary C2 hosts, email addresses, or payload URLs has been disclosed, leaving the full scope of the operation uncertain.

Defenders should add the IP address 104.21.72.214 to network‑level deny lists, enforce blocking of the domain at DNS resolvers, and monitor for any future re‑registration attempts. Continuous observation of Cloudflare‑hosted assets associated with this IP is recommended, as the provider can host many unrelated legitimate services. Correlation with other detections that reference the same SSL certificate or page title may reveal further instances of the same kit. Because the site is already offline, immediate remediation focuses on preventing re‑use of the same domain or IP by threat actors.