promosenlineacreddenciales[.]onrender[.]com

The domain promosenlineacreddenciales.onrender.com is currently flagged as an active credential phishing site impersonating Linea, a recognized blockchain infrastructure provider. Analysis confirms this domain is designed to harvest user credentials under the guise of a legitimate service, with the page title displaying 'Service Suspended' to create urgency or panic in potential victims. The threat type is classified as brand impersonation with a high-risk assessment due to its operational status and direct targeting of sensitive authentication data. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 216.24.57.251, hosted on AS397273 Render in the United States. The domain was created on February 21, 2026, an anomalous future date that may indicate an attempt to evade detection or mislead automated systems. Security vendor assessments show 18 of 95 engines on VirusTotal flag the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing sites. Google Safe Browsing has explicitly categorized this domain as phishing, and it is blocked by PhishDestroy, further corroborating its malicious intent. Current status remains active, posing an ongoing risk to users who may encounter the domain through phishing campaigns, malicious advertisements, or compromised redirects. Organizations and individuals are advised to implement immediate network-level blocks for the domain and its associated IP address. Endpoint protection systems should be updated to include this domain in real-time threat intelligence feeds. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window, particularly those associated with Linea or related blockchain services. Security teams are encouraged to monitor for lateral movement or unauthorized access attempts stemming from credentials harvested via this phishing infrastructure.