land-ip[.]com

Analysis of land-ip.com indicates a brand impersonation campaign aimed at the foundation brand. The domain was registered on August 14, 2025 and is hosted behind Cloudflare’s network (AS13335), resolving to IP address 172.67.172.153 located in the United States. The authoritative nameservers listed are stella.ns.cloudflare.com and sullivan.ns.cloudflare.com, confirming Cloudflare as the registrar and DNS provider. The site returns HTTP 200 responses and presents a valid SSL certificate issued by Google Trust Services under the WE1 designation, demonstrating an effort to appear legitimate. The page title observed is “Living Console Showcase,” which does not directly reference the targeted brand but is likely used to disguise the malicious intent.

The domain has been flagged by PhishDestroy and appears on one public security blocklist, and it is referenced in two AlienVault OTX threat‑intelligence pulses, providing external corroboration of its malicious nature. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high risk assessment despite the lack of detections from VirusTotal scans. Detected technologies include Cloudflare Browser Insights, Cloudflare services, and HTTP/3, indicating the use of modern web protocols to improve performance and evade simple detection. The current operational status is offline, but the infrastructure components remain active and could be repurposed for future campaigns.

Defenders should immediately block traffic to 172.67.172.153 and add land‑ip.com to web‑filter and DNS blocklists. Continuous monitoring of Cloudflare‑hosted domains that share the same nameservers or exhibit similar page‑title patterns is advised, as the attacker may recycle the same hosting configuration for new impersonation attempts. Updating intrusion‑detection signatures to flag the specific page title “Living Console Showcase” and the brand‑impersonation indicator for foundation will help mitigate exposure.