land-app4[.]top

land-app4.top was observed in active phishing infrastructure targeting Gmail users. The domain was registered through NiceNIC International Group Co., Limited on 9 July 2025 and currently resolves to IP 142.251.40.196, which is owned by Google LLC (ASN 15169) and geolocated in the United States. DNS resolution is served by Cloudflare nameservers darl.ns.cloudflare.com and nina.ns.cloudflare.com, and the site negotiates HTTP/3 over a TLS certificate issued by Google Trust Services under the WE1 label, indicating that the certificate chain is valid for the host. The page title returned by the HTTP response is “Google”, matching the brand target of Gmail indicated in the intelligence.

VirusTotal scans show that five of ninety‑five security vendors flagged the domain as malicious, and the domain appears on a single external blocklist maintained by PhishDestroy. AlienVault OTX includes the domain in one threat‑intelligence pulse. The domain is currently listed as taken offline, but historical activity suggests it was used for brand‑impersonation attacks. No additional content analysis is available beyond the page title; the specific phishing page layout, credential‑capture mechanisms, or redirection behavior have not been publicly disclosed.

Defenders should continue to block the domain at network perimeters, add the associated IP address to deny lists, and monitor for any re‑registration or resurrection attempts. Continuous telemetry from DNS, HTTP, and TLS logs is recommended to detect possible reuse of the Cloudflare infrastructure or the Google‑owned IP range for future impersonation campaigns. The presence of a valid Google certificate should not be interpreted as trust, and security teams should treat any traffic to land‑app4.top as hostile.