claim-lineabulid[.]xyz

The domain claim-lineabulid.xyz was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and first observed on September 10, 2025. The site hosted a page whose HTML title was reported as “Et øjeblik …”, a Danish phrase meaning “One moment …”. No TLS certificate was presented; the site responded only over IPv6 address 2606:4700:3034::6815:3aa, which belongs to Cloudflare’s network (AS13335) located in the United States. Nameserver records point to louis.ns.cloudflare.com and veronica.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. Scamadviser assigned a trust score of 40 out of 100, indicating a low‑reputation registrant.

The domain appears on a single public blocklist and has been flagged by the PhishDestroy feed. VirusTotal analysis shows that five of ninety‑five scanning engines returned a positive detection, reinforcing the malicious classification. Threat intelligence associates the domain with a “Crypto Scam” that impersonates the Linea brand. The limited evidence suggests the operator likely crafted the page to lure victims into cryptocurrency‑related fraud, though the exact payload or transaction flow has not been captured. Because the site is currently offline, active investigation of its content is constrained; the only observable artifact is the page title and the lack of SSL, which are consistent with a hastily deployed scam page.

Defenders should add claim-lineabulid.xyz to inbound and outbound filtering rules, especially for traffic to Cloudflare‑hosted IPv6 addresses, and monitor for any future resolution to different IPs. Threat‑intel platforms should update indicator sets with the domain, its registrar, and the associated nameservers. Because the domain was flagged by multiple vendors, any detection of similar crypto‑related phishing attempts targeting Linea should be correlated. Continuous re‑query of blocklist feeds and VirusTotal is recommended to capture any re‑appearance.