collab-land-api[.]vercel[.]app

Analysis of collab-land-api.vercel.app indicates a phishing domain impersonating Collab.Land, as evidenced by the page title 'Collab.Land Connect' and technical infrastructure consistent with credential harvesting attempts. The domain was registered on February 21, 2026, through Tucows Domains Inc. and is hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States, resolving to IP address 216.198.79.3. SSL certification is provided by Google Trust Services (WR1), and HTTP Strict Transport Security (HSTS) is enforced, which may lend a superficial appearance of legitimacy to targets.

As of July 24, 2026, the domain returns an HTTP 451 status, indicating it has been taken offline, likely due to enforcement actions or hosting provider intervention. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and was flagged by 3 of 93 security vendors on VirusTotal. While the exact phishing methodology remains unconfirmed due to the domain's current offline status, the combination of impersonation targeting, hosting on a common cloud provider, and detection by multiple security vendors suggests an elevated risk profile.

Defenders should treat this domain as malicious and consider blocking it at the network level. Historical DNS and WHOIS records should be preserved for forensic analysis, and any associated email addresses or IP ranges should be monitored for further malicious activity. Given the domain's registration recency and rapid takedown, additional related infrastructure may still be active or emerge in the near term.