mrie-line-assistance-ca[.]surge[.]sh

The domain mrie-line-assistance-ca.surge.sh was registered on February 21, 2026 through Tucows Domains Inc. and is configured to impersonate the Linea brand, as indicated by the intelligence feed. DNS resolution points to the IP address 159.203.50.177, which belongs to AS14061 DigitalOcean, LLC and is geolocated to Canada. An SSL certificate for the hostname is present; it was issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA hierarchy, confirming that TLS termination is active on the server.

HTTP requests to the site return a 404 status code and the page title reports "Unavailable," suggesting that the malicious landing page has been taken down. Despite the offline status, the domain remains listed on at least one security blocklist and was flagged by PhishDestroy. Google Safe Browsing classifies the URL as a social engineering threat, and VirusTotal analysis shows that 13 of 93 scanned security vendors flagged the domain, reinforcing the suspicion of malicious intent.

The combination of brand impersonation, a valid TLS certificate, and multiple independent detections indicates a high‑risk phishing infrastructure targeting users of the Linea service. Defenders should continue to block the domain and the associated IP address at network perimeters, monitor for any re‑registration or new subdomains on the same IP range, and consider adding the domain to internal threat intelligence feeds. Ongoing observation of the registrar and hosting provider for similar patterns is recommended, as is the use of external threat‑intel feeds to capture any future re‑activation of the infrastructure.