linea[.]beefyhubs[.]cfd

Analysis of the domain linea.beefyhubs.cfd as of 25 July 2026 shows that it was registered through Dynadot LLC on 21 October 2025 and is configured to use Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The domain resolves to IP 192.178.218.106, which belongs to AS15169 Google LLC and is geolocated to the United States. No TLS certificate is presented, indicating that the site does not serve HTTPS traffic. The page title returned from the HTTP response is "Google", which does not correspond to the advertised brand. The domain is explicitly marked as a brand‑impersonation campaign targeting Linea, and the scam classification matches the provided "Brand Impersonation" label.

VirusTotal has recorded 11 detections out of 95 scanned engines, and the domain appears on at least one external blocklist. PhishDestroy has taken the site offline, and its current status is reported as offline. The observable indicators confirm that the infrastructure was deliberately set up to mimic a legitimate brand, yet the lack of SSL and the generic page title suggest a low‑effort front‑end. The presence of Cloudflare name servers may be used to hide the true origin of the malicious payload, while the hosting IP being part of Google's network could complicate takedown efforts. The detection count on VirusTotal and inclusion on a blocklist provide concrete evidence that security products have already flagged the domain.

Uncertainty remains regarding the exact payload delivered to victims, as no content analysis is available. The short lifespan (registered less than a year before takedown) limits the opportunity for longitudinal observation, and the absence of additional intelligence such as phishing kit fingerprints or URL paths prevents a more granular attribution.