land-api2[.]top

Analysis of land-api2.top, observed as offline at the time of assessment on July 24, 2026, indicates a deliberate brand‑impersonation campaign targeting Discord users. The site served a page titled “Collab.Land,” which aligns with the known Discord‑related service Collab.Land, suggesting the domain was used to lure victims by mimicking that service. The domain was registered on June 29, 2025 through NiceNIC International Group Co., Limited and resolves to the IP address 76.76.21.21, an Amazon.com, Inc. host (AS16509) located in the United States. Cloudflare is listed as the DNS provider, with nameservers cecelia.ns.cloudflare.com and pranab.ns.cloudflare.com, and the site leveraged HTTP/3, indicating a modern delivery stack.

SSL termination is performed by Google Trust Services under the WE1 certificate, which provides a valid TLS certificate but does not mitigate the malicious intent. Reputation signals are poor: Gridinsoft assigns a trust score of 0 / 100, and three of ninety‑five VirusTotal scanners flagged the domain as malicious. The domain appears on a single security blocklist and has been cited in one AlienVault OTX pulse, confirming that threat‑intel communities have observed it in the wild. PhishDestroy has already blocked the domain, reinforcing its classification as a brand‑impersonation vector.

Uncertainty remains regarding the exact phishing kit or payload, as no visual or functional details of the landing page were captured. Defenders should continue to block land‑api2.top at network perimeters, update URL filtering feeds with the domain and its associated IP, and monitor for any resurgence on the listed IP address or Cloudflare nameservers. Further DNS and TLS monitoring is advised to detect potential re‑use of the infrastructure for new impersonation campaigns targeting Discord or related services.