Zimbra webmail phishing pages on Weebly: zimbfree, zimbrafree9 and zim-update2025

What happened

PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe two French-language webmail login pages styled after the French internet provider Free (zimbfree, which shows Zimbra branding and Free adverts, and zimbrafree9, titled "Webmail Free") and a Zimbra-branded sign-in form with a "VERIFY" button (zim-update2025), all asking for a login and password. They were flagged by 16 to 18 of 92 VirusTotal engines. Zimbra, a webmail system used by many universities, companies and internet providers, and Free are the brands being spoofed and are not involved. Do not enter mailbox passwords on pages reached from "mailbox update" or "quota" emails. The domains are also on the Phishing Army blocklist.

How the scam works

These pages copy a familiar login, payment or delivery form so that a typed password, one-time code, card number or other personal detail goes to the operator rather than to the real company. The address is often a look-alike domain, a newly registered shop, or a free host such as Weebly, Wix, Firebase, Vercel, Workers or Pages. Some kits cloak the real form from scanners and only show it in certain countries or to certain devices. The brand whose name or logo appears is being impersonated and is not involved, unless the report says the page was planted on a compromised official site, in which case only that path is the phishing lure. Open the official app or type the company's real address yourself. If you already entered a password or a card number, change the password on the official site, turn on a new two-factor method, and contact the company and your bank.

Source

Source: https://mastodon.social/@phishdestroy/117604232617643364 (PhishDestroy (@phishdestroy@mastodon.social), Nov 12, 2026, 10:42 AM ET)