checker[.]linea[.]tools

Analysis of the domain checker.linea.tools indicates a high‑confidence crypto‑related impersonation campaign targeting the Ethereum brand. The domain was registered on February 21, 2026 and resolves to the IPv6 address 2606:4700:3033::ac43:aea3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presents the page title "Linea: The home network for the world," a generic statement that does not reference Ethereum directly, but the intelligence record lists the brand target as Ethereum and classifies the scam type as a crypto scam. The SSL certificate is identified as "WE1," confirming that the site employed HTTPS, a common tactic to lend legitimacy.

Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100 and Scamadviser a score of 1 / 100, reflecting the site’s malicious nature. Independent blocklists have already flagged the domain; it appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer. VirusTotal analysis shows that one of ninety‑five scanning engines flagged the domain, providing additional corroboration of its malicious intent.

No further content has been captured, and the site is currently offline, limiting immediate interaction but not eliminating residual risk from cached resources or linked infrastructure. Defenders should add checker.linea.tools and its underlying Cloudflare IPv6 address to blocklists, monitor for any future re‑registration or use of similar subdomains, and treat any traffic claiming to originate from this domain as hostile. Continuous observation of the associated IP range and related certificate signatures is advised to detect potential pivot activity.