collab[.]land-safe[.]app

On July 24, 2026, the domain collab.land-safe.app was examined following multiple detections by commercial anti‑phishing services. The domain was registered on October 15, 2025 through NiceNIC International Group Co., Limited and is served by Cloudflare nameservers brenda.ns.cloudflare.com and renan.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:3031::6815:331f, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, indicating the site operated without HTTPS encryption.

The page title returned by the HTTP response is "Collab.Land", but the site is currently taken offline, preventing live content inspection. Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 / 100 and Gridinsoft 0 / 100. The domain is listed on two security blocklists and has been actively blocked by PhishDestroy and ScamSniffer. VirusTotal analysis shows that eight of ninety‑five AV engines flagged the domain as malicious, reinforcing the phishing assessment.

The available evidence confirms that collab.land-safe.app was used as a generic phishing landing page, likely intended to harvest credentials or lure users under the guise of a legitimate Collab.Land service. Uncertainty remains regarding the specific phishing kit, payload, or victim demographics because the site is no longer reachable and no content archive exists. Defenders should immediately add the domain and its resolving IPv6 address to network‑level blocklists, enforce DNS sinkholing for the associated Cloudflare nameservers, and monitor for any related C2 traffic. Continuous re‑evaluation is advised in case the infrastructure is re‑hosted under new subdomains or IP ranges.