gov-db635f70-zlimbra-4528-48ac-6460e3[.]netlify[.]app

Analysis of gov-db635f70-zlimbra-4528-48ac-6460e3.netlify.app shows a recently registered Netlify‑hosted site that has been taken offline. The domain was created on February 23, 2026 and is registered through Name.com, Inc. Infrastructure inspection reveals the site resolved to the Amazon Web Services address 54.253.94.210, which is assigned to AS16509 in Germany. The TLS certificate presented is a DigiCert Global G2 RSA SHA256 2020 CA1 chain, issued by DigiCert Inc, and the site advertised HSTS support. The page title captured during the brief online window was "Zimbra Web Client Sign In," matching the declared scam type of credential phishing targeting Zimbra users.

HTTP response returned a 404 status code, indicating the content was no longer served at the time of checking. Threat intelligence feeds list the domain on a single security blocklist and note that PhishDestroy has actively blocked it. VirusTotal scans recorded nine of ninety‑three antivirus engines flagging the domain as malicious, reinforcing the phishing assessment.

While the exact phishing landing page cannot be examined because the site is offline, the combination of a deceptive Zimbra‑related title, credential‑phishing classification, reputable SSL certificate, and corroborating blocklist entries provide strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter, monitor for any re‑hosting attempts on Netlify or other cloud providers, and update endpoint protection signatures to include the observed VirusTotal detections. Further investigation may focus on any associated URLs or email campaigns that reference this domain to assess potential victim exposure.