spin-linea[.]com

The domain spin-linea.com was registered on March 13, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.37.109 located in the United States. DNS resolution points to the Cloudflare nameservers mira.ns.cloudflare.com and rustam.ns.cloudflare.com, and the site serves traffic over HTTP/3 using Cloudflare Browser Insights. The TLS certificate is issued by Let’s Encrypt (R13), indicating a standard, automated certificate provisioning process. When accessed, the HTTP response returned the page title “Just a moment…”, a generic placeholder often presented by Cloudflare when a site is under protection or in a temporary state, and no additional content was captured before the domain was taken offline.

VirusTotal analysis shows that four of ninety‑four security vendors flagged the domain, and it is listed on a single external security blocklist. PhishDestroy has also added spin-linea.com to its blocklist, confirming that the domain is being used for malicious purposes. The threat classification supplied is brand impersonation, specifically targeting the Linea brand, which aligns with the reported scam type.

Current observations are limited to infrastructure and metadata; the actual payload, credential‑stealing pages, or social‑engineering vectors have not been retrieved because the site is offline. Defenders should therefore treat the domain as a confirmed malicious indicator, add it to network and email filtering rules, monitor for any re‑appearance of the same hostnames or IP addresses, and consider broader Cloudflare‑associated ranges as potentially suspicious when associated with similar brand‑impersonation activity. Ongoing vigilance is advised, especially given the recent registration date and the use of reputable hosting services that can mask malicious intent.