0auth-collab[.]land

Analysis of the domain 0auth-collab.land indicates a high‑risk phishing operation that is currently active. The domain was registered on 21 July 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on the IP address 188.114.97.3, which is served by Cloudflare nameservers aida.ns.cloudflare.com and carter.ns.cloudflare.com. The SSL certificate presented by the site is issued by Google Trust Services under the WE1 intermediate, indicating that TLS termination is performed by a legitimate certificate authority. VirusTotal has recorded detections from 2 of 91 scanning engines, confirming that at least a subset of security vendors consider the host malicious.

The domain is already listed on a public phishing blocklist operated by PhishDestroy and appears on one additional security blocklist, reinforcing the consensus of malicious intent. No public page title or content analysis is presently available, so the exact phishing lures or target brands remain unverified. Nevertheless, the convergence of recent registration, active status, vendor detections, and inclusion on blocklists provides sufficient evidence for defensive action. Organizations should immediately add 0auth-collab.land to DNS‑based and proxy URL filtering rules, monitor outbound connections to 188.114.97.3, and enforce verification of the Google Trust Services certificate to detect any certificate pinning bypass.

Incident response teams should treat any authentication attempts directed at this domain as compromised and advise users to avoid entering credentials. Ongoing threat hunting should include searching for email subjects or attachments that reference “0auth‑collab” and correlating any internal logs that contain the domain or its IP. As additional intelligence (e.g., page content, malware payloads, or victim reports) becomes available, updates to detection signatures and blocklist entries should be applied.