zimbrastat[.]com

Analysis of the domain zimbrastat.com indicates it is actively engaged in credential-harvesting phishing targeting Zimbra webmail users. The domain was registered on December 17, 2025, through NameCheap, Inc., and currently resolves to the IP address 64.226.124.190. As of August 1, 2026, the domain remains operational, with no evidence of takedown or deactivation. Infrastructure analysis reveals the use of registrar-provided nameservers (dns1.registrar-servers.com and dns2.registrar-servers.com), a common pattern in phishing campaigns to evade immediate detection.

VirusTotal telemetry shows that 20 of 91 security vendors flag zimbrastat.com as malicious, though the specific detection categories (e.g., phishing, malware, or generic threat) are not disclosed in available data. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy, further corroborating its malicious classification. No additional contextual details, such as the hosting provider's autonomous system number (ASN) or geographic location, are currently available. The exact content and structure of the phishing page remain unanalyzed, as no page title, brand impersonation details, or phishing kit identifiers were provided in the available intelligence.

However, the domain name itself suggests an intent to impersonate Zimbra, an open-source email and collaboration platform, likely to deceive users into submitting login credentials. Defenders should treat this domain as high-risk infrastructure and prioritize blocking it at the DNS, network, and email gateway levels. Organizations using Zimbra should alert users to the threat and reinforce phishing awareness, particularly for messages directing recipients to webmail login pages hosted on non-corporate domains. Further investigation into the IP address 64.226.124.190 may reveal additional linked phishing domains or command-and-control infrastructure.