land-web3[.]app

This domain, land-web3.app, has been taken offline but remains listed on a security blocklist and was previously blocked by PhishDestroy. Infrastructure analysis shows it resolved to the IP address 76.76.21.21, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The authoritative name servers are may.ns.cloudflare.com and wilson.ns.cloudflare.com, indicating that Cloudflare services were used for DNS and CDN. The site presented an SSL certificate issued by Google Trust Services under the WE1 root, confirming the use of a valid TLS chain despite the malicious intent.

Detected technologies include Cloudflare and HTTP/3, consistent with the observed hosting environment. Brand‑targeted impersonation is evident from the declared target “discord” and the page title “Collab.Land”, which suggests an attempt to lure Discord users into an investment‑related scheme. The campaign is classified as an investment scam. Reputation metrics are extremely low: Gridinsoft assigned a trust score of 0 out of 100, and AlienVault OTX references the domain in a single threat‑intel pulse.

VirusTotal analysis recorded three positive detections out of ninety‑five scanned vendors, reinforcing the malicious classification. Defenders should add 76.76.21.21 and land‑web3.app to network‑level deny lists, enforce DNS filtering that includes the domain, and monitor for any resurgence of the same IP or Cloudflare name‑server pair. Because the SSL certificate is valid, reliance on certificate validation alone will not block the threat; instead, correlation with the observed page title, brand target, and low trust scores should be used to trigger alerts. Continuous review of emerging blocklist entries and OTX updates is recommended to capture any re‑registration attempts.