m4-4ad0-bc1d-zimbra-76fd724f94-1cf408[.]netlify[.]app

The domain m4-4ad0-bc1d-zimbra-76fd724f94-1cf408.netlify.app, registered on February 21 2026 through Name.com and hosted on Netlify, is currently offline and returns an HTTP 404 status. DNS resolution points to the IPv6 address 2a05:d014:58f:6200::259, which maps to an Amazon.com, Inc. (AS16509) infrastructure located in Germany. The site presents a valid DigiCert Global G2 TLS RSA SHA256 certificate issued by DigiCert Inc, and HSTS is enforced, indicating a properly configured HTTPS service despite the malicious intent. The page title "Zimbra Web Client Sign In" reveals that the site is crafted to lure credentials for Zimbra web clients, aligning with the known scam type of credential phishing.

Google Safe Browsing flags the domain for social engineering, and PhishDestroy has blocked it, confirming its classification as a phishing resource. VirusTotal analysis shows that 14 of 93 security vendors have flagged the domain, providing additional corroboration of malicious behavior. Nameservers dns1.p01.nsone.net through dns4.p01.nsone.net are in use, which is typical for domains managed via Name.com.

While the site is no longer reachable, the existing indicators—hosted on a reputable CDN, valid SSL, and targeted page title—demonstrate that the adversary leveraged trusted infrastructure to increase the perceived legitimacy of the credential‑stealing page. Defenders should ensure the domain is added to internal URL filtering and DNS blocklists, monitor for any resurgence of the same host or similar subdomains, and enforce multi‑factor authentication for Zimbra accounts to mitigate credential theft. Continuous threat‑intel feeds should be consulted for any new detections related to the associated IP range or Netlify‑hosted phishing campaigns.