Security Scan: Zimbra Web Client Sign In

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/13cb905b-3e5e-4bfc-a508-ef9675c1e383 Domain and IP registration (RDAP)/api/v1/rdap/13cb905b-3e5e-4bfc-a508-ef9675c1e383How often this domain was scanned/api/v1/domain/stats/fromtop.pages.dev Scan history for this domain/api/v1/domain/history/fromtop.pages.dev?limit=15

This website contacted 3 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: https://fromtop.pages.dev/.git/HEAD

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Cloned Zimbra sign-in page on a free pages.dev subdomain that posts captured usernames and passwords to an unrelated Cyrillic punycode domain; corroborated phishing threat-intel. Definitive credential phishing.

Risk Factors (5)

Impersonation of the Zimbra/Synacor brand on a non-official domain

Credential-harvesting login form (username + password) with a cross-origin action to an unrelated punycode domain

Multi-source phishing threat-intelligence match on the scanned domain

Free/shared Cloudflare Pages subdomain with unverifiable creation date

Unranked domain with minimal legitimacy signals

Domain age information unavailable

Details

Page Title

Zimbra Web Client Sign In

Scan Type

public

Favicon Hash

MMH3: 1624375939

MD5: 8c7d1c14e4b9c42f07bd6b800d93b806

Domain Name Analysis

The domain 'fromtop.pages.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'fromtop'. The core label 'pages' covers 5 characters containing 2 vowels alongside three consonants. Tokenizing the label suggests one word: pages. Expect five characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

0.72s

Total Load Time

19 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:923 chars

Detector Agreement:67%

Website Classification

Primary Category

unknown0% confidence

Type: webapp

Method: structural

All Detected Categories

No categories detected

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
2	172.66.44.71Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	195.96.242.68	Sofia, Sofia-Capital, Bulgaria	AS8745Bulgarian Academy of Sciences
1	172.66.47.185Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
4	3	-	-