4a60b417-zimbra-8d7f-web-o4286-fd24f6[.]netlify[.]app

Analysis indicates that the domain 4a60b417-zimbra-8d7f-web-o4286-fd24f6.netlify.app was registered on February 23, 2026 through Name.com, Inc. and hosted on a Netlify infrastructure that resolves to the IPv4 address 18.208.88.157, an Amazon.com, Inc. (AS16509) server located in Germany. The site presented the page title "Zimbra Web Client Sign In" and returned an HTTP 404 status, suggesting that the expected login endpoint is no longer reachable. TLS negotiation employed a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate issued by DigiCert Inc., confirming the presence of a valid SSL chain. Security telemetry shows that the domain was flagged by PhishDestroy and appears on one external blocklist.

VirusTotal scans recorded 12 detections out of 93 security vendors, reflecting moderate consensus that the domain is malicious. The classification in the intelligence set lists the campaign as credential phishing, targeting Zimbra web client credentials. Current operational status is offline, indicating that the phishing page has been taken down or is otherwise inaccessible. Uncertainty remains regarding the exact content that was served prior to takedown, as the 404 response provides no visible payload.

Defenders should continue to block the domain at network perimeter, update URL filtering lists, and monitor related Netlify sub‑domains for similar patterns. Additional investigation of the associated IP range and ASN may reveal further infrastructure used by the actor. Continuous re‑evaluation of detection vendor scores is advised, as the 12/93 flag count may evolve with subsequent scans.