collaber[.]cfd

The domain collaber.cfd was registered on February 21, 2026 and is currently offline. DNS resolution points to the IPv4 address 188.114.96.3, which is hosted by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presented the page title "Sign in - Google Accounts," indicating an attempt to lure victims into providing Google credentials.

VirusTotal analysis recorded 19 detections out of 93 security vendors, confirming that a substantial portion of the scanning community classifies the domain as malicious. The same domain appears in a single AlienVault OTX pulse and is listed on one public blocklist, where it has been flagged by the PhishDestroy mitigation service. An SSL certificate identified as WE1 was observed in the TLS handshake, suggesting the use of a generic certificate rather than a brand‑specific one.

The combination of a brand‑targeted page title, elevated detection count, and inclusion on threat‑intelligence feeds supports the classification of collaber.cfd as a credential‑phishing infrastructure targeting Google users. Defenders should continue to block the domain at network perimeter controls, monitor for any residual DNS queries, and ensure that endpoint protection solutions are updated to reflect the 19 VirusTotal detections. Although the site is no longer active, the underlying IP address remains under Cloudflare control, so any future re‑use of the same host should be re‑evaluated against the observed indicators of compromise.