auths-collab[.]land

This domain, auths-collab.land, is identified as a brand impersonation threat targeting Microsoft. The site presents itself as a legitimate authentication portal under the title 'Collab.Land Connect,' a tactic designed to deceive users into disclosing credentials or sensitive information. Current analysis confirms the domain is offline, though prior activity aligns with phishing campaigns impersonating trusted services to harvest login details or distribute malicious payloads.

Infrastructure analysis reveals the domain was registered on March 23, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.206.109, hosted on infrastructure associated with Cloudflare, Inc. in Canada. Detection metrics indicate 17 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two independent security blocklists. Notably, the domain lacks an SSL certificate, a deviation from standard security practices for legitimate authentication portals. Additional scrutiny confirms blocking by two specialized anti-fraud systems, further validating its malicious classification.

As of the latest assessment, auths-collab.land remains offline, though the underlying infrastructure may persist. Organizations are advised to proactively block the domain and its associated IP (172.67.206.109) at the network perimeter. Security teams should monitor for related domains registered under the same registrar or resolving to identical infrastructure. End-user training should emphasize verification of authentication portals, particularly those mimicking Microsoft services, and the risks of interacting with unencrypted (HTTP-only) sites. Incident response protocols should include immediate credential rotation for any accounts potentially exposed to this domain.