lineadropcheck[.]xyz

Analysis of the domain lineadropcheck.xyz indicates it was actively impersonating the Linea brand as part of a phishing operation. The domain was registered on September 29, 2025, through NiceNIC International Group Co., Limited, and resolved to the IP address 172.67.171.152, hosted on Cloudflare's infrastructure (AS13335) in the United States. The domain's nameservers, carmelo.ns.cloudflare.com and kelly.ns.cloudflare.com, further confirm its association with Cloudflare's network. At the time of assessment, the domain was flagged by one security blocklist (PhishDestroy) and detected by 6 of 95 security vendors on VirusTotal, suggesting moderate confidence in its malicious classification.

The domain's HTTP response returned a page titled 'Just a moment...', a generic placeholder commonly associated with Cloudflare-protected sites or those undergoing filtering. No SSL certificate was present, increasing the likelihood of interception or manipulation of unencrypted traffic. Infrastructure analysis reveals the domain was taken offline by July 24, 2026, though its prior activity and registration details align with known brand impersonation tactics.

Defenders should treat this domain as a confirmed threat vector for Linea users, particularly given its explicit targeting of the brand. While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, lack of SSL, and detection by multiple security vendors warrants blocking at the DNS and proxy levels. Organizations should monitor for connections to 172.67.171.152 and review logs for prior interactions with lineadropcheck.xyz, particularly from systems associated with Linea-related activities.