eng-desktop[.]zapier[.]app

This domain is flagged as an elevated-risk phishing site specializing in brand impersonation of Ledger, a cryptocurrency hardware wallet provider. The threat specifically targets users attempting to access Ledger Live desktop software, presenting a fraudulent interface designed to harvest login credentials, recovery phrases, or facilitate unauthorized transactions. Infrastructure analysis reveals the domain mimics legitimate wallet management tools, increasing the likelihood of successful social engineering attacks against cryptocurrency holders. Analysis indicates the domain eng-desktop.zapier.app was registered through Name.com, Inc. on April 17, 2026, and resolves to the IP address 64.239.123.129. The site employs a Let's Encrypt SSL certificate and utilizes technologies including Amazon Web Services, Vercel, Stripe, reCAPTCHA, HSTS, and Amazon S3, suggesting an attempt to appear legitimate. Detection metrics show 14 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist and is assigned a Gridinsoft trust score of 0/100. The page title 'Ledger Live®® Desktop Getting' further confirms the intent to impersonate official Ledger software. Mitigation requires immediate blocking of the domain and associated IP address 64.239.123.129 across all network security layers. Cryptocurrency users should verify software authenticity by downloading Ledger Live exclusively from the official ledger.com domain or verified app stores. Organizations should implement domain monitoring for similar impersonation patterns, particularly those using subdomains of legitimate SaaS platforms. Endpoint protection should be configured to detect and prevent access to newly registered domains exhibiting cryptocurrency-related keywords. Users who may have interacted with this domain should immediately transfer assets to new wallets and revoke any connected application permissions.