verify-collab[.]land

This domain operates as a credential harvesting platform targeting users of the Collab.Land token-gating service. The site presents a fraudulent interface mimicking Collab.Land's legitimate wallet verification process, designed to trick victims into entering sensitive wallet credentials or approving malicious transactions. Analysis indicates the infrastructure specifically targets cryptocurrency users through social engineering tactics that exploit trust in the Collab.Land brand. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain verify-collab.land was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 25, 2026, with an anomalous future creation date suggesting potential domain spoofing. It currently resolves to Cloudflare IP address 104.21.29.55 and maintains an active Let's Encrypt SSL certificate (E7). Security vendors have flagged this domain at a rate of 10/95 on VirusTotal, while it appears on five distinct security blocklists. Additional protective measures have been implemented by multiple wallet security providers, indicating widespread recognition of the threat. Users who have visited verify-collab.land should immediately revoke any wallet approvals granted through the site and transfer assets to a new wallet address. All credentials entered on the platform should be considered compromised, necessitating password resets for associated accounts. Affected parties should monitor transaction histories for unauthorized activity and report the incident to relevant blockchain security teams. The domain remains active as of this analysis, requiring continued vigilance from potential targets.