land-verification[.]app

This domain, land-verification.app, is flagged as an active credential phishing site targeting users through deceptive verification-themed lures. Registered on March 26, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to 104.21.43.250, a Cloudflare-hosted IP located in Canada. Infrastructure analysis reveals Cloudflare nameservers (anita.ns.cloudflare.com and greg.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), which are commonly observed in phishing campaigns leveraging CDN services to obscure origin servers and evade detection. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed, while AlienVault OTX records it in a single pulse, indicating prior malicious activity. VirusTotal reports that 8 out of 95 security vendors flag the domain as malicious, reinforcing its classification as high-risk. The HTTP response code is 403, and the page title reads 'Just a moment...', a pattern consistent with Cloudflare-protected phishing pages awaiting victim redirection or serving interstitial blocks to evade automated crawlers. The lack of visible content does not diminish the threat, as such behavior is often used to filter security tools while allowing human targets to proceed. Defenders should treat this domain as an active threat. The registration age (under four months) and use of Cloudflare infrastructure align with tactics used in short-lived phishing campaigns. Network-level blocking of 104.21.43.250 and associated Cloudflare IPs is recommended, along with monitoring for related subdomains or certificate reuse. The domain's presence on multiple threat feeds suggests it is part of a broader campaign, though the specific brand or service being impersonated remains unconfirmed. Security teams should correlate this domain with other land- or verification-themed phishing attempts to identify potential patterns or infrastructure overlaps.