g-collab[.]land

This domain is flagged as a high-risk crypto drainer targeting users through brand impersonation of Collab.Land. Analysis indicates the site is designed to deceive visitors into connecting wallets, enabling unauthorized token transfers or asset theft. The threat type aligns with known crypto drainer infrastructure, which exploits trust in legitimate platforms to execute malicious transactions. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain g-collab.land resolves to IP address 76.76.21.21 (AS13335 Cloudflare, Inc., US), and was registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports 4 out of 95 security vendors flagging the domain, while the SSL certificate is issued by Google Trust Services (WE1). The page title mimics the legitimate Collab.Land, further confirming the impersonation tactic. Mitigation steps specific to this threat include immediate blocking of the domain and IP at the network level. Users should verify wallet connection prompts and avoid interacting with unsolicited links, particularly those shared via social media or direct messages. Wallet extensions or security tools configured to detect crypto drainers should be enabled, and transaction simulations can help identify unauthorized token approvals. Organizations should monitor for similar impersonation domains using the same registrar or IP infrastructure, as these may indicate coordinated phishing campaigns.