Security Scan: Zimbra Web Client Sign In

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/a6ac10fd-1ed0-40e3-a451-fdba31459621 Domain and IP registration (RDAP)/api/v1/rdap/a6ac10fd-1ed0-40e3-a451-fdba31459621How often this domain was scanned/api/v1/domain/stats/pub-c2334fdd999f4aa98cbc1d7c3b0ee0b1.r2.dev Scan history for this domain/api/v1/domain/history/pub-c2334fdd999f4aa98cbc1d7c3b0ee0b1.r2.dev?limit=15

This website contacted 1 IP in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is r2.dev and was registered 4 years 2 months ago.

Submitted URL: https://pub-c2334fdd999f4aa98cbc1d7c3b0ee0b1.r2.dev/mails.html

AI Security Verdict

Confirmed Scam

Confidence: 97%

Risk Score

Fake Zimbra Web Client login hosted on a Cloudflare R2 bucket that posts harvested usernames and passwords to the unrelated domain fteinc.us; IDS also flags shellcode and obfuscated script traffic. Credential phishing.

Risk Factors (5)

Brand impersonation of Zimbra/Synacor on a non-official cloud-storage host

Password-harvesting form posting cross-origin to fteinc.us/stared/zmform.php

Cloudflare R2 public bucket used to host a login page

CRITICAL and HIGH IDS alerts indicating shellcode/heap-spray and hex-obfuscated script content

No legitimate business identity, legal pages, or contact information matching the claimed brand

Domain age information unavailable

Details

Page Title

Zimbra Web Client Sign In

Scan Type

public

Domain Name Analysis

You're looking at domain 'pub-c2334fdd999f4aa98cbc1d7c3b0ee0b1.r2.dev' on the developer-focused generic top-level domain (.dev) and includes subdomain 'pub-c2334fdd999f4aa98cbc1d7c3b0ee0b1'. The registrable portion 'r2' spans 2 characters containing zero vowels alongside one consonant; it also includes one digit. Tokenizing the label suggests 2 words: r, 2. Expect one character per word on average. No strong language cues emerged from the frequency lists.