Security Scan: Zimbra Web Client Sign In

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/31063626-d940-4a9c-a07c-a79db6a511fe Domain and IP registration (RDAP)/api/v1/rdap/31063626-d940-4a9c-a07c-a79db6a511fe Certificate Transparency/api/v1/ct/br-zim.netlify.app How often this domain was scanned/api/v1/domain/stats/br-zim.netlify.app Scan history for this domain/api/v1/domain/history/br-zim.netlify.app?limit=15

This website contacted 3 IPs in 2 countries across 1 domain to perform 1 HTTP transaction. The main domain is netlify.app and was registered 8 years ago.

Submitted URL: https://br-zim.netlify.app/

AI Security Verdict

Confirmed Scam

Confidence: 95%

Risk Score

Fake Zimbra Web Client sign-in hosted on a Netlify subdomain that posts usernames and passwords to submit-form.com. Clear credential phishing with brand impersonation — never enter credentials here.

Risk Factors (4)

Brand impersonation of Zimbra (Synacor) on a non-official netlify.app subdomain

Credential-capturing form with a password field submitting cross-origin to submit-form.com

Threat-intelligence phishing report on the domain

Datacenter-IP scanner received a block/challenge page while residential clients saw the real login page, indicating bot-protection evasion on a credential-harvesting page

Domain age information unavailable

Details

Page Title

Zimbra Web Client Sign Inother network

Scan Type

public

Domain Name Analysis

The domain 'br-zim.netlify.app' uses the application-focused generic top-level domain (.app), featuring subdomain 'br-zim'. Count 7 characters in 'netlify' split between 2 vowels and five consonants. Tokenizing the label suggests three words: net, li, fy. Median word length is 2 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

75.13s

Total Load Time

N/A

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:738 chars

Detector Agreement:67%

Website Classification

Primary Category

technology software64% confidence

Type: webapp

Method: ml+structural

All Detected Categories

technology software

64%

corporate business

39%

documentation technical

32%

government public service

28%

social_media

25%

Detected Features

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
1	35.157.26.135Aws · CLOUD	Frankfurt am Main, Hesse, Germany	AS16509Amazon.com, Inc.
0	93.94.224.225	Netherlands	AS25151Cyso Group B.V.
0	63.176.8.218Aws · CLOUD	Frankfurt am Main, Hesse, Germany	AS16509Amazon.com, Inc.
1	3	-	-

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1FFB2D86625E518610AA370FC59CF111934B49C2B1009CE087DFC92A83FB5D7A56B7BFE

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:gqjhRgFO3nhkxUT4OmYXhl2Ei0m5HDpupShi4i2iZi5iFieigiMiniHiNJci8i9:pjD3nhkxUT4Om6tc/oVHgA0v9BiCNJRH

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:23699:BAIaNLRw6IvBgDIMgGKlqKEHXEAACTHcyCUASAFKACJugIkCAm8HVcLFBJgAZoIIKSIA7hWgxtgENGgoocAXgiAECACUSlFC

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000181818180000

Perceptual Hash:99da26f689a4d923

Difference Hash:504cb2b2b232cef3

Wavelet Hash:f07cfeff1f980000

Color Hash:#931f67

Other Hashes

Crop Resistant:9ab8e2d2b032b2e0,504cb2b2b232cef3

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: br-zim.netlify.app