land-api9[.]top

Analysis of the domain land-api9.top indicates a phishing threat targeting users of the Collab.Land platform, as evidenced by the page title 'Collab.Land' extracted from its HTTP response. The domain was registered on February 21, 2026, through 耐思尼克国际集团有限公司 and is currently offline. Infrastructure analysis reveals hosting on Amazon Web Services (AS16509) with an IP resolution of 76.76.21.21, located in the United States. The domain employs Cloudflare nameservers (elias.ns.cloudflare.com, kay.ns.cloudflare.com) and supports HTTP/3, alongside a Google Trust Services SSL certificate (WE1).

Detection data shows the domain appears on one security blocklist, while AlienVault OTX records it in a single threat intelligence pulse. VirusTotal reports two detections from 93 security vendors, though the specific nature of these detections remains unconfirmed. The domain's registration and hosting patterns align with known phishing infrastructure, particularly its use of Cloudflare and a recently created domain name.

Defenders should treat this domain as a confirmed phishing threat, particularly for users of Collab.Land, and implement blocking at DNS or proxy levels. Further investigation into associated IPs, SSL certificates, and registrar activity is recommended to identify related malicious infrastructure. No evidence currently suggests active exploitation, but historical data should be reviewed for prior connections to compromised accounts or credential theft.