linera[.]run

The domain linera.run was registered on March 12, 2026 through Global Domain Group LLC. It resolves to the Cloudflare‑owned address 104.21.3.154, which is announced by AS13335 and geolocated in the United States. The domain is currently active and serves a single HTTP 301 redirect, indicating a live infrastructure that can be quickly modified. Infrastructure analysis shows the domain uses Cloudflare’s DNS service, with authoritative nameservers peter.ns.cloudflare.com and melina.ns.cloudflare.com. The site is protected by a Let’s Encrypt certificate (issuer E8) and employs modern web stacks including React, HTTP/3, HSTS, and Cloudflare Browser Insights. These technologies are typical for legitimate sites, which can help the malicious page evade casual scrutiny. The page title presented to visitors is “The Linera Portal”, directly mimicking the legitimate Linea brand. The campaign is classified as brand impersonation and has been listed on two independent security blocklists—PhishDestroy and ScamSniffer. VirusTotal scans have resulted in 2 of 95 security vendors flagging the domain, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious intent. Defenders should block DNS resolution for linera.run at the network perimeter and add the domain to URL filtering policies. Email gateways should be configured to quarantine messages that reference the domain or contain the phrase “The Linera Portal”. Continuous monitoring of Cloudflare‑served IP 104.21.3.154 for new malicious payloads is advised, and incident response teams should treat any credential submissions to this site as compromised.