lfg[.]linea[.]cx

This domain, lfg.linea.cx, operates as a high-risk brand impersonation phishing site targeting users of Linea, a blockchain platform. The site mimics legitimate Linea services, specifically presenting itself as a 'Link in Bio' or LINK3 page, likely designed to harvest credentials, private keys, or other sensitive information from unsuspecting victims. Analysis indicates the infrastructure is configured to deceive users into believing they are interacting with an official Linea resource, increasing the likelihood of successful social engineering attacks. The presence of a fraudulent interface, combined with the domain’s recent creation and association with a known blockchain brand, suggests a targeted campaign to exploit trust in the Linea ecosystem. Evidence supporting this assessment includes multiple technical indicators. The domain is flagged by 13 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered on October 8, 2025, through CentralNic Ltd, a registrar frequently utilized for both legitimate and fraudulent domains. The domain appears on at least one security blocklist and is actively blocked by Google Safe Browsing for phishing. Infrastructure analysis reveals the domain resolves to IP address 172.67.202.11, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to conceal the true origin of malicious activity. The SSL certificate, issued by Google Trust Services (WE1), further mimics legitimacy while failing to validate the site’s authenticity. Users who have visited lfg.linea.cx or interacted with its content should take immediate action to mitigate potential risks. Any credentials, wallet addresses, or private keys entered on the site should be considered compromised and revoked immediately. Affected users are advised to disconnect any connected wallets or sessions linked to the domain and monitor their accounts for unauthorized transactions. If financial assets were exposed, users should report the incident to relevant blockchain security teams and consider engaging with professional incident response services. Additionally, users should scan their devices for malware, as phishing sites often deploy secondary payloads to maintain persistence or exfiltrate data. Vigilance is critical, as brand impersonation campaigns often reuse infrastructure or domains for follow-up attacks.