land-join[.]top

The domain land-join.top was registered on May 29, 2025 through NiceNIC International Group Co., Limited and is currently taken offline. Infrastructure analysis shows the domain resolves to IP address 76.76.21.21, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. DNS resolution is handled by Cloudflare nameservers brian.ns.cloudflare.com and luciane.ns.cloudflare.com, and the site served HTTP/3 traffic via Cloudflare’s edge network. The SSL certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS chain but offering no assurance of legitimacy.

The page title returned from the site was "Collab.Land," a name that does not directly reference the targeted brand but may be leveraged to lend credibility to the impersonation campaign. The threat classification is brand impersonation targeting Discord, and the domain appears on one security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis recorded four detections out of ninety‑five scanning engines, confirming that multiple security vendors have identified malicious activity associated with the domain. AlienVault OTX lists the domain in a single threat pulse, providing additional corroboration of its malicious nature.

Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in the domain’s safety. While the exact content of the site has not been publicly captured, the combination of brand targeting, low trust scores, multiple vendor detections, and active blocklist listings indicates a high likelihood of phishing or credential‑harvesting intent. Defenders should continue to block land-join.top at network perimeter devices, update URL filtering and threat intelligence feeds, and monitor the IP address 76.76.21.21 for any re‑use in future campaigns. Continuous re‑scanning of the domain, should it reappear, is recommended to capture any changes in payload or hosting infrastructure.