land-discord[.]app

This domain, land-discord.app, was observed as part of a brand‑impersonation campaign targeting Discord users. The site is currently offline, returning HTTP 523 from Cloudflare, and its DNS resolves to 76.76.21.21, an address owned by Amazon.com, Inc. (AS16509) located in the United States. Cloudflare’s HTTP/3 service is active, and the TLS certificate is issued by Google Trust Services under the WE1 organization, indicating a legitimate certificate chain but not protecting against malicious use. The authoritative nameservers are alina.ns.cloudflare.com and logan.ns.cloudflare.com, which are typical for Cloudflare‑hosted domains. The page title returned by the server is “Collab.Land”, which does not reference Discord and suggests that the content has not been publicly verified.

The registrar listed for the domain is NiceNIC International Group Co., Limited. Security telemetry shows a Gridinsoft trust score of 0 / 100 and inclusion on one security blocklist. The domain appears in a single AlienVault OTX pulse, and PhishDestroy has listed it as blocked. VirusTotal analysis recorded detections from six of ninety‑five scanners, confirming that multiple security vendors flag the domain as malicious.

The classified scam type is “Social Media Phishing”, and the domain explicitly impersonates the Discord brand. Because the site is offline, active exploitation cannot be confirmed at this time, but the combination of a zero trust score, blocklist presence, multiple vendor detections, and verified phishing classification indicates a high likelihood of malicious intent. Defenders should continue to block land‑discord.app at perimeter and DNS layers, monitor for any re‑activation of the IP address, and consider adding the domain to internal threat‑intel feeds. Additional investigation of the underlying web content, if the site returns online, would be required to determine the exact phishing vector and any credential‑harvesting mechanisms.