v6-collab[.]land

This domain is flagged for elevated-risk brand impersonation targeting Google. Analysis indicates the infrastructure was designed to deceive users by mimicking official Google services, likely to facilitate credential harvesting or unauthorized access to sensitive accounts. The threat type is classified as brand impersonation, a tactic commonly used to exploit trust in established brands for malicious purposes. Infrastructure analysis reveals the domain v6-collab.land resolves to IP address 188.114.96.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 09, 2026. The domain appears on 2 security blocklists and is flagged by 12 out of 95 security vendors on VirusTotal. Additional indicators include a Gridinsoft trust score of 0/100 and detection of technologies such as Vercel, HubSpot, HSTS, and Cloudflare Browser Insights. The page title, Collab.Land, further suggests an attempt to impersonate legitimate collaboration platforms. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and page title into endpoint detection and response (EDR) systems, web proxies, and email security gateways. User awareness training should emphasize verifying domain authenticity, particularly for login portals or collaboration tools, and reporting suspicious URLs. Security teams are advised to monitor for related domains registered under the same registrar or resolving to the identified IP address.