en-us-appstart[.]zapier[.]app

This domain, en-us-appstart.zapier.app, is identified as a brand impersonation phishing site targeting Ledger, a cryptocurrency hardware wallet provider. The page title, "Ledger Live®® Desktop," mimics the legitimate Ledger Live application interface, aiming to deceive users into entering sensitive credentials or downloading malicious software. No specific drainer kit was confirmed, but the presence of Stripe and reCAPTCHA suggests an attempt to appear legitimate while potentially harvesting payment details or bypassing automated detection systems. Analysis indicates the domain was registered through Name.com, Inc on September 21, 2022, and resolves to the IP address 64.239.109.1. It is flagged by 9 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is not listed on Google Safe Browsing. The SSL certificate is issued by Let's Encrypt, and the site employs technologies such as Amazon Web Services, Vercel, Amazon S3, and HSTS, which are commonly used in both legitimate and malicious infrastructures. The domain is currently offline, likely due to takedown actions or suspension by the hosting provider. Despite its inactive status, the remaining risk includes potential reuse of the infrastructure or repurposing of the domain for future phishing campaigns. Users who may have interacted with this domain are advised to monitor for unauthorized transactions, rotate credentials, and verify the authenticity of any Ledger-related communications. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.