linea-guild[.]org

Analysis as of July 24, 2026 indicates that linea-guild.org is an active brand‑impersonation infrastructure targeting the blockchain platform Linea. The domain was registered on 02 Oct 2025 through NameSilo, LLC and is hosted on Cloudflare’s network (ASN 13335) with the A record 172.67.193.12, a US‑based edge location. DNS resolution points to Cloudflare nameservers damon.ns.cloudflare.com and mary.ns.cloudflare.com, which is consistent with the lack of a dedicated SSL certificate; no TLS certificate was observed for the site. The sole page title retrieved before takedown was the Hebrew phrase “רק רגע...” (“Just a moment…”), which provides no further indication of malicious content but aligns with typical placeholder pages used in phishing kits.

The domain appears on a single security blocklist and was flagged by the PhishDestroy sinkhole service, confirming that it was actively used for malicious activity. VirusTotal reports indicate that two of ninety‑five scanned security vendors flagged the domain, suggesting partial detection. No additional public intelligence such as OTX or Safe Browsing was cited. The site’s current status is offline, and mitigation actions have removed its public accessibility.

Uncertainty remains regarding the specific payload delivered to victims, the presence of credential‑stealing forms, and whether any compromise of the underlying Cloudflare account occurred. Defenders should continue to block the domain at perimeter and DNS layers, monitor related Cloudflare IP ranges for similar activity, and update detection signatures to include the observed page title and the resolver IP. Ongoing surveillance of the registrar NameSilo for new domains that share similar naming patterns is advised, as attackers often reuse registration services. Coordination with threat‑share feeds to propagate the observed indicators will help reduce exposure to this brand‑impersonation campaign.