ag-collab[.]land

Analysis of the domain ag-collab.land indicates it is actively flagged as a high-risk phishing site. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to IP address 104.21.30.139, hosted behind Cloudflare infrastructure in Canada. Nameservers coen.ns.cloudflare.com and leanna.ns.cloudflare.com further confirm Cloudflare's role in its hosting. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites, offering no definitive classification on its own. As of July 20, 2026, the domain remains active with an HTTP 200 status, suggesting it is serving content. It appears on one security blocklist, and two out of 91 security vendors on VirusTotal have flagged it as malicious. While the low detection count does not confirm widespread recognition of the threat, the presence of any detections in a large sample set is notable. The specific phishing target or brand impersonation is not yet confirmed in available data, though the domain name suggests a focus on collaboration platforms. Defenders should treat ag-collab.land as an active threat. Network-level blocking is recommended, particularly for organizations using collaboration tools. Further analysis of the site's content and behavior is necessary to determine the exact phishing kit or campaign in use. Monitoring for additional detections or blocklist additions may provide further clarity on its malicious intent.