collabox[.]net

Analysis of collabox.net, observed on July 25, 2026, indicates that the domain is being leveraged for credential phishing directed at users of the ET‑SIGN service, as evidenced by the page title “Login – ET‑SIGN”. The domain was registered on March 06, 2026 through NiceNIC International Group Co., Limited and resolves to IP address 104.21.29.106, which belongs to AS13335 Cloudflare, Inc., placing the hosting location in the United States. DNS resolution is handled by the Cloudflare nameservers dara.ns.cloudflare.com and lennon.ns.cloudflare.com, and the site is reachable via HTTP/3 and Cloudflare Browser Insights, employing Tailwind CSS for its front‑end framework. No SSL certificate was observed, meaning the connection is not protected by TLS.

The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple mitigation services have identified it as malicious. Reputation scoring from Gridinsoft assigns a trust value of 0 out of 100, reflecting an extremely low confidence level. VirusTotal scanning shows three out of ninety‑four security vendors flagging the domain, further corroborating its malicious intent. Current operational status is offline, suggesting the phishing site may have been taken down or is temporarily inaccessible.

Defenders should continue to block collabox.net at network perimeters, ensure that any cached or historic URLs are denied, and monitor for re‑hosting attempts that may reuse the same infrastructure or page title. Because the underlying infrastructure relies on Cloudflare, future iterations could appear under different subdomains while retaining the same IP range, so continuous DNS‑based detection and blocklist updates are recommended. The lack of an SSL certificate provides an additional indicator for automated filtering systems. Overall, the available evidence confirms that collabox.