collabox[.]org

Analysis of the domain collabox.org indicates it was actively involved in a phishing campaign targeting users of collaboration platforms. The domain was registered on March 6, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolved to IP address 172.67.137.52, hosted on Cloudflare's network (AS13335) in the United States. The use of Cloudflare nameservers (poppy.ns.cloudflare.com and quentin.ns.cloudflare.com) and the absence of an SSL certificate are consistent with tactics observed in phishing operations aiming to evade detection while maintaining low-cost infrastructure.

The page title, 'Collabox - All-in-One Collaboration Platform,' suggests an attempt to impersonate a legitimate collaboration service, though no specific brand or product is confirmed as the direct target based on available evidence. As of the report date, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which classify it as malicious. Detection engines on VirusTotal flagged the domain, with 2 out of 94 vendors identifying it as phishing-related. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk domain.

The domain has since been taken offline, likely due to enforcement actions or infrastructure changes by the threat actor. Defenders should treat any prior resolution to 172.67.137.52 as an indicator of compromise and monitor for related domains registered through the same registrar or utilizing similar Cloudflare-hosted infrastructure. While the exact content of the phishing page remains unanalyzed, the combination of detection counts, blocklist presence, and infrastructure characteristics provides sufficient evidence to classify collabox.org as a phishing domain. Organizations are advised to update filtering rules to block access to this domain and any associated IPs or subdomains.