linelogin[.]me

linelogin.me was registered through Dynadot Inc on July 18, 2025 and is currently pointing to the IPv6 address 2600:9000:2013:2400:2:dc71:3640:93a1. The address belongs to AS13335 operated by Cloudflare, Inc., and the domain uses the Cloudflare nameservers fatima.ns.cloudflare.com and moura.ns.cloudflare.com. A Let’s Encrypt certificate (issued to E7) secures the site, and the HTTP response is a 302 redirect that delivers a page titled “LINE｜always at your side.”

VirusTotal analysis shows that 10 out of 95 security vendors have flagged the domain, indicating a moderate consensus of malicious intent. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, and AlienVault OTX references the domain in a single threat‑intel pulse. These signals collectively reinforce the classification of the site as a credential‑phishing operation targeting LINE users.

The observed infrastructure suggests a fast‑flux style deployment using Cloudflare’s CDN, which masks the true origin server and complicates takedown efforts. The use of a legitimate Let’s Encrypt certificate provides a veneer of authenticity, while the page title mimics the official LINE branding to lure victims into entering their credentials. The 302 redirect may be employed to forward victims to a credential‑harvesting form hosted elsewhere, a pattern commonly seen in credential‑phishing campaigns.

Defenders should block DNS resolution for linelogin.me at the network perimeter and add the IPv6 address to outbound filtering rules. Email security gateways should be updated to flag messages that contain URLs or references to this domain, and users should be educated about the spoofed “LINE｜always at your side.” page title. Continuous monitoring of Cloudflare‑associated IP ranges and periodic re‑scanning with VirusTotal are recommended to detect any re‑hosted copies of the payload.