zimbras-wondrous-site[.]webflow[.]io

The domain zimbras-wondrous-site.webflow.io was registered on 23 February 2026 through NameCheap, Inc. and resolves to the Cloudflare‑owned address 172.64.151.8, located in the United States and announced under ASN 13335 (Cloudflare, Inc.). The TLS certificate presented is issued by Google Trust Services to the WE1 entity, confirming that HTTPS connections are terminated by Cloudflare’s edge. Network analysis shows the site employs Cloudflare services and HTTP/3, indicating modern transport optimisation but also providing anonymity for the operator. VirusTotal scanned the domain and 16 of 93 security vendors reported it as malicious, contributing to its classification as a generic phishing resource.

The page title returned by the server is “Zimbra's Wondrous Site”, yet the HTTP response code is 404, meaning the expected content is not currently available. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy service, reinforcing the view that it was used for phishing campaigns. Current observations indicate the site has been taken offline, but the infrastructure—Cloudflare front‑end, the registered domain, and the SSL certificate—remains usable for future re‑hosting.

Defenders should continue to monitor DNS resolution for the address 172.64.151.8, enforce blocklist entries, and update web gateway or endpoint filters with the domain name. Because the underlying hosting provider is Cloudflare, any new payload would likely be served from the same edge network, so reputation‑based controls are advisable. Further analysis is limited by the lack of captured page content; investigators should seek HTTP archives or sandbox captures if the domain resurfaces.