collab-land-deploy[.]vercel[.]app

This domain, collab-land-deploy.vercel.app, is flagged for high-risk brand_impersonation targeting Discord. Analysis indicates a deliberate attempt to mimic legitimate Collab.Land services to deceive users into disclosing credentials or installing malicious payloads. The infrastructure exhibits multiple indicators of compromise, aligning with known phishing campaigns impersonating collaboration platforms.

Infrastructure analysis reveals the following technical details: the domain resolves to IP 64.29.17.67 (US, AS16509 Amazon.com, Inc.), with a creation date of February 21, 2026. Security vendors flagged the domain in 2 of 95 scans, while it appears on 3 blocklists. The SSL certificate (Google Trust Services/WR1) and page title ('Collab.Land Connect') further correlate with Discord impersonation tactics. The registrar, Tucows Domains Inc., has been associated with prior abuse reports. Despite its recent creation date, the domain remains active and employs deceptive branding elements to exploit trust in the Collab.Land name.

To mitigate brand_impersonation risks, organizations should implement the following controls: enforce domain validation for all inbound communications, particularly those soliciting credentials. Deploy network-level blocking for the domain and its resolving IP (64.29.17.67) across perimeter defenses. Conduct user training to recognize impersonation techniques, such as mismatched URLs or urgent authentication requests. Monitor for similar infrastructure patterns (e.g., Vercel-hosted domains with 'collab-land' prefixes) and correlate with Discord-themed phishing campaigns. Immediate takedown requests should be filed with the registrar and hosting provider, citing the 2/95 detection ratio and blocklist status as evidence of malicious intent.