collabox[.]io

Analysis as of July 25, 2026 indicates that collabox.io is currently offline but was previously observed serving a page titled “Collabox – All‑in‑One Collaboration Platform”. The domain was registered on March 6, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 188.114.97.3, hosted within ASN 13335 in the United States. DNS is delegated to brynne.ns.cloudflare.com and kobe.ns.cloudflare.com, confirming Cloudflare as the authoritative provider. The site employed a Let’s Encrypt E7 certificate, which was valid at the time of observation, and leveraged Cloudflare Browser Insights and HTTP/3, indicating a modern delivery stack.

Reputation signals are strongly negative: the domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0 / 100. VirusTotal recorded detections from two of ninety‑four scanned engines, reinforcing the malicious classification. The threat type has been identified as generic phishing, suggesting the site was used to harvest credentials or lure victims without targeting a specific brand.

Uncertainty remains regarding the exact content of the page and any credential‑capture mechanisms, as no visual analysis is available. Defenders should continue to block collabox.io at perimeter and DNS layers, monitor for any resurgence of the domain, and add the IP address 188.114.97.3 to network‑level blocklists. Incident response teams should also review recent logs for any outbound connections to the domain or its IP during the window between registration and the offline status. Ongoing vigilance is advised given the recent creation date and the use of reputable hosting services that can be repurposed for short‑lived phishing campaigns.