hub-linea[.]build

The domain hub-linea.build is actively serving a page titled “MetaMask: The Leading Crypto Wallet Platform, Blockchain Wallet,” a clear indication of a crypto‑related lure. Registration records show the domain was created on September 03, 2025 through Porkbun LLC, and it resolves to the IP address 172.64.147.181, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 certificate authority, suggesting the attackers have obtained a trusted TLS credential to increase credibility. HTTP analysis reveals the server returns a 302 redirect, a technique often used to guide victims to a credential‑ harvesting endpoint after an initial landing page.

The infrastructure stack includes Contentful, Node.js, React, Vercel, Next.js, Twitter Ads, reCAPTCHA, and Osano, all typical components of modern web applications and indicative of a deliberately constructed phishing front‑end. The domain is listed on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, reinforcing the conclusion that it is being used for malicious purposes. VirusTotal scans show five out of ninety‑five antivirus engines flag the domain, providing additional independent confirmation of its suspicious nature. The Gridinsoft trust score of 0 out of 100 signals an extremely low reputation.

The site explicitly impersonates the Linea brand and is categorized as a crypto scam, meaning victims may be prompted to connect a wallet or transfer assets under false pretenses. While the exact payload or credential‑capture mechanism has not been publicly disclosed, the presence of reCAPTCHA suggests attempts to avoid automated takedown. Defenders should block network resolution to 172.64.147.181, add hub-linea.build to domain deny lists, and monitor for any outbound connections to the indicated IP or to known crypto exchange endpoints from internal hosts.