land-dao[.]top

On July 24, 2026 analysts observed that the domain land-dao.top is currently offline but retains a set of indicators consistent with a brand‑impersonation campaign targeting Discord users. The site presented the page title “Collab.Land”, a name that does not directly reference Discord but is listed as the impersonated brand in the intelligence feed. The domain was registered on 14 June 2025 through NiceNIC International Group Co., Limited and is hosted on Amazon’s AS16509 network, resolving to the IP address 76.76.21.21 located in the United States. DNS resolution is served by Cloudflare nameservers elinore.ns.cloudflare.com and pedro.ns.cloudflare.com, and the web server advertised HTTP/3 support, indicating a modern transport layer.

The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming a valid HTTPS endpoint at the time of capture. VirusTotal scans returned six positive detections out of ninety‑five submitted samples, suggesting the presence of malicious components that triggered multiple security engines. The domain appears on a single public blocklist and is specifically listed by the PhishDestroy blocklist, reinforcing its classification as a phishing vector. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, and AlienVault OTX recorded the domain in one threat‑intel pulse, providing additional community corroboration.

While the page content has not been captured, the combination of a Discord‑related impersonation claim, a brand‑focused page title, and the observed technical artifacts point to a deliberate attempt to harvest credentials or lure Discord users. The offline status prevents direct interaction, but the infrastructure—Cloudflare front‑end, Amazon hosting, and a legitimate SSL certificate—remains reusable for future campaigns.