land-dis[.]top

Analysis of land-dis.top shows a confirmed brand impersonation campaign targeting Discord users. The domain was created on June 23 2025 and is registered through NiceNIC International Group Co., Limited. Infrastructure inspection reveals that the domain resolves to IP 76.76.21.21, which belongs to AS16509 Amazon.com, Inc. and is located in the United States. The site is fronted by Cloudflare, employing HTTP/3 and presenting an SSL certificate issued by Google Trust Services under the WE1 designation. Nameservers anderson.ns.cloudflare.com and cass.ns.cloudflare.com confirm the Cloudflare hosting layer.

Reputation scoring is uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, where it has been flagged and blocked by PhishDestroy. AlienVault OTX records a single pulse referencing this indicator, and VirusTotal reports that 2 of 95 security vendors have flagged the domain as malicious. The page title observed during the brief capture was "Collab.Land," which does not match the impersonated brand but reinforces the presence of a crafted landing page. The current operational status is offline, yet the elevated risk rating suggests the infrastructure could be re‑activated.

Defenders should immediately block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions. Continuous monitoring of Cloudflare‑hosted assets linked to the same nameservers is advised, as threat actors often reuse the same hosting configuration for subsequent campaigns. Incorporating the domain’s hash into internal threat intel feeds and sharing the indicator with partner ISPs and industry blocklist operators will help prevent recurrence. Given the low trust score and the presence of multiple vendor detections, any traffic attempting to resolve land-dis.top should be treated as hostile until a formal takedown confirmation is received.