lineafund[.]org

The domain lineafund.org was registered on September 16, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare infrastructure (ASN AS13335). DNS resolution points to the IP address 172.67.191.200, which is geolocated to the United States. The domain uses Cloudflare's default nameservers razvan.ns.cloudflare.com and sierra.ns.cloudflare.com and does not present an SSL/TLS certificate, indicating that HTTPS connections are not established. A single security blocklist currently flags the domain, and PhishDestroy has actively blocked it.

VirusTotal analysis shows that one out of ninety‑five scanned security vendors flagged the domain as malicious, providing the only vendor‑level detection available. The observed HTTP response returned the page title "Nur einen Moment…", which is the sole visible content indicator captured. The site is categorized as a brand impersonation campaign targeting the Linea brand, consistent with the listed scam type. As of the report date, July 22, 2026, the domain is taken offline, limiting immediate exposure but leaving the infrastructure footprint intact.

Defenders should continue to monitor the IP address 172.67.191.200 and associated Cloudflare ASN for any reactivation or related activity, enforce blocklist updates to include the domain, and consider extending protection rules to cover similar Cloudflare‑hosted impersonation domains. Because the site lacks an SSL certificate and only a single vendor flagged it, confidence in the malicious classification relies on the blocklist entry, the PhishDestroy block, and the brand‑impersonation label. Further investigation is recommended to confirm the exact payload or phishing workflow, should the domain become active again.