trzro[.]zapier[.]app

This domain, trzro.zapier.app, is actively impersonating the official Trezor hardware wallet setup page. Visitors are presented with a fraudulent interface labeled 'Trézor.io/Start® - Official®,' designed to mimic the legitimate Trezor onboarding process. The site likely functions as a crypto drainer, tricking users into entering recovery phrases or private keys, which attackers then use to steal cryptocurrency from connected wallets. The use of a legitimate app automation platform subdomain adds a layer of perceived authenticity, increasing the risk of successful deception. Analysis indicates this domain is flagged by 18 out of 95 security vendors on VirusTotal, a clear indicator of malicious intent. The SSL certificate is issued by Let's Encrypt, a common tactic among phishing operators to create a false sense of security through HTTPS encryption. Infrastructure analysis reveals the domain resolves to the IP address 64.239.123.1, which may be part of a broader phishing infrastructure. The subdomain structure, hosted on a reputable platform, suggests an attempt to bypass basic security filters by leveraging trusted service domains. If a user has visited trzro.zapier.app and entered any sensitive information, immediate action is required. First, disconnect the device from the internet to prevent further data transmission. Next, transfer all cryptocurrency holdings from any potentially compromised wallets to new, secure wallets with fresh recovery phrases. Monitor connected accounts for unauthorized transactions and enable additional security measures such as two-factor authentication. Users should also report the domain to their wallet provider and relevant cybersecurity organizations to aid in takedown efforts. No further interaction with the domain should occur, and browser caches should be cleared to remove any stored data.