Download websites that use Zimbra

About Zimbra

Zimbra arrives in this dataset under Webmail, and the label needs a caveat before anything else. The software is a collaboration server rather than a campaign tool, carrying mail, calendars, contacts, tasks and shared documents behind a single web interface. A category name records where a detection sits in our taxonomy, not what the vendor built.

The signal worth paying for is self-hosting. An organization that buys mail as a service leaves no mail server of its own facing the public internet, so there is nothing to fingerprint. A Zimbra web client answering on a company domain means somebody inside that company decided to run the platform, patch it, and expose a login page to the world. Written in Java, first released in 2005 and available under GPL v2, the platform ships as a community build and as a commercial edition sold by Synacor, so one detection can cover a university department using the free release and a bank paying for archiving and support.

Two audiences read that population for opposite reasons. Security teams treat exposed collaboration servers as an asset class with a long incident history, and a roster of hosts running one is where exposure work, customer notification and patch-lag research all start. Sales teams at competing mail and groupware vendors read the same roster as accounts that already own the problem, already staff it, and have a renewal date somewhere in the calendar.

As of October 2026 we detect the platform on 1,079 sites. A per-domain lookup confirms one host and tells you nothing about the shape of the population around it, which is usually the real question: how many organizations still run this, in which sectors, on which domains, and whether the number moves between one export and the next. A downloadable list answers all four in a single pass, and repeated exports turn the same list into a migration curve rather than a snapshot.

Two limits belong on the record. Detection depends on a public-facing surface, normally a webmail entry point or a response header, so any deployment reachable only through a VPN or an internal network is invisible to us and the count is a floor rather than a census. We also carry no edition or release detail here, so the list will not separate the community build from the paid one and will not tell you which hosts are current. What it does give you is the set of domains where the platform is running and reachable, which for most research questions is the expensive part to assemble.