cloud-collab[.]land

Analysis of cloud-collab.land confirms active phishing infrastructure targeting cloud collaboration or storage credentials as of July 19, 2026. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to 188.114.97.3, a Cloudflare IP located in Canada. Infrastructure review shows Cloudflare nameservers (vera.ns.cloudflare.com, eoin.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which may help defenders identify related malicious domains using the same certificate authority. The site returns an HTTP 200 status, indicating an operational landing page, though the exact content and targeted brand remain unconfirmed. AlienVault OTX records link this domain to two threat intelligence pulses, and it appears on one security blocklist (PhishDestroy). VirusTotal scans flag the domain as malicious by 10 of 91 security vendors, providing additional detection context for network defenders. Defenders should prioritize blocking this domain at the DNS and network level, particularly in environments where cloud storage or collaboration tools are used. Monitoring for connections to 188.114.97.3 or domains with the same SSL issuer (Google Trust Services / WE1) may help identify related phishing activity. Given the domain's active status and presence on multiple threat feeds, it should be treated as high-risk until further analysis or takedown occurs.