auth[.]collaber[.]top

This domain is flagged as a high-risk Google brand impersonation credential harvester targeting user authentication data. Analysis indicates the infrastructure was specifically designed to mimic Google Accounts login portals, as evidenced by the page title 'Sign in - Google Accounts' and the absence of SSL encryption, a deliberate tactic to evade detection while capturing entered credentials. Infrastructure analysis reveals the domain auth.collaber.top was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 104.21.29.222 (AS13335 Cloudflare, Inc., US) and is currently offline. Security telemetry shows 20 out of 95 vendors on VirusTotal flag the domain as malicious, with detections including phishing and brand impersonation. The domain appears on one security blocklist, and Google Safe Browsing categorizes it as phishing infrastructure. The creation date discrepancy (2026) suggests domain age manipulation to bypass reputation-based filters. Mitigation requires immediate credential rotation for any accounts accessed via this domain, particularly Google-related services. Network administrators should block the domain and IP 104.21.29.222 at perimeter defenses. Users should enable multi-factor authentication on all accounts and scrutinize login portals for discrepancies in URL structure, SSL certificates, and page content. Organizations should monitor for authentication attempts from Cloudflare IP ranges associated with this infrastructure and implement DMARC/DKIM/SPF policies to prevent similar brand impersonation attempts. Security teams should treat any login attempts via this domain as compromised credentials and investigate for subsequent unauthorized access.