open-collab[.]space

PhishDestroy identifies the domain open-collab.space as a credential-harvesting node currently under active investigation for phishing. This site mimics collaborative platforms to trick users into submitting login credentials, which are then harvested by attackers for follow-on compromise. The domain resolves to IP 104.21.84.173 and holds a Let’s Encrypt SSL certificate to appear trustworthy, yet VirusTotal currently shows 0/95 detections, indicating it has not yet been widely blacklisted. This domain was flagged by PhishDestroy’s generic phishing pipeline, with further evidence including registration through PDR Ltd. d/b/a PublicDomainRegistry.com on March 29, 2026. The fresh registration, coupled with zero VirusTotal detections and the absence of formal blocklist entries, suggests a recently stood-up infrastructure designed to evade early detection. Attackers often leverage newly registered domains to host phishing pages that harvest credentials from unsuspecting users under the guise of legitimate collaboration tools. If you visited open-collab.space and entered any credentials or personal information, immediately change those passwords on a separate, trusted device and enable multi-factor authentication where available. Monitor accounts for unusual activity and consider revoking any session tokens issued from this domain. Report the incident to your IT security team and run a full antivirus scan on the device used to access the site. Avoid re-engaging with the domain and warn colleagues who may have been targeted.