lineaspin[.]org

The domain lineaspin.org was registered on October 01, 2025 through NameSilo, LLC. It resolves to 104.21.83.61, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain currently shows no SSL certificate and the HTTP service has been taken offline; the page title observed before takedown was "Nur einen Moment…". The site was identified as a brand‑impersonation campaign targeting the cryptocurrency platform Linea, and the activity was classified as a crypto‑gambling scam. The domain appears on one security blocklist and is specifically listed by PhishDestroy as blocked.

VirusTotal analysis recorded detections by two of ninety‑five scanners, confirming that at least a subset of security vendors consider the domain malicious. Nameserver records point to damon.ns.cloudflare.com and mary.ns.cloudflare.com, consistent with the Cloudflare hosting infrastructure. The combination of recent registration, lack of TLS, low detection count, and the presence on a dedicated blocklist suggests a short‑lived, targeted operation rather than a long‑standing infrastructure. Uncertainty remains around the exact payload delivered, the extent of user interaction, and whether additional infrastructure shares the same IP range.

Defenders should add lineaspin.org to deny‑list rules, monitor DNS queries for the domain and its associated IP, and enforce TLS inspection for outbound connections to Cloudflare‑hosted IPs. Further investigation of the two VirusTotal detections may reveal payload signatures or command‑and‑control indicators. Continuous tracking of the registrar NameSilo for new domains with similar naming patterns is recommended to pre‑empt future impersonation attempts.