eng-collab[.]land

Analysis of eng-collab.land shows an active web presence returning HTTP 200 responses. The domain is delegated to Cloudflare nameservers chloe.ns.cloudflare.com and rommy.ns.cloudflare.com and resolves to IP 188.114.96.3, a Cloudflare edge node located in Canada. TLS is provided by a Google Trust Services certificate issued to WE1, indicating a valid HTTPS configuration. Registration records list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, but no further registrant details are disclosed. Four of ninety‑one security vendors on VirusTotal have flagged the domain, and it is listed on a single phishing blocklist operated by PhishDestroy. The combination of a live site, Cloudflare‑hosted infrastructure, a trusted SSL certificate, and modest vendor detections aligns with typical characteristics of a generic phishing site. No additional intelligence such as page content, phishing kit, or targeted brand has been released, leaving the precise lure and victim profile undefined. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any new detections or reputation changes, and consider adding the IP address to threat‑intel feeds. Ongoing observation is advised to capture any future payloads or credential‑harvesting activity that may emerge.