zimbra[.]goteal[.]io

The domain zimbra.goteal.io, registered with GoDaddy and hosted on AWS infrastructure, engages in credential phishing activities. Despite its creation in 2016, it was first detected by PhishDestroy as a threat on March 23, 2026. Currently, it is offline, but it has been flagged as malicious by 9 out of 95 vendors on VirusTotal, and appears on one public blocklist maintained by PhishDestroy.

This domain targets users by imitating legitimate services to steal credentials. The use of AWS EC2 infrastructure in the US suggests a potentially broad target audience, leveraging the reputation of a well-known cloud provider to avoid immediate suspicion. The platform risk score of 63 out of 100 indicates a moderate threat level, highlighting the domain's potential effectiveness in deceiving users.

Though the site is currently offline, its prior activity underscores the persistent threat posed by phishing domains. The rapid detection by PhishDestroy, ahead of many antivirus vendors, demonstrates the importance of early threat identification. This case exemplifies how phishing domains exploit the critical window between registration and widespread detection to execute attacks.