bridge-nav-get[.]zapier[.]app

PhishDestroy identifies bridge-nav-get.zapier.app as an active crypto-draining phishing domain under live campaign analysis. This subdomain is weaponized to harvest private wallet keys and seed phrases under the guise of a legitimate Zapier file-transfer workflow. The infrastructure is provisioned on a freshly registered Zapier-branded subdomain, indicating an opportunistic hijack of a legitimate automation service to deliver malicious payloads. Current detection coverage remains critically low at 6/95 on VirusTotal, leaving most endpoint and network defenses blind to the threat.

Technical indicators confirm the domain resolves to IPv4 64.239.123.1 via Let’s Encrypt SSL, establishing a thin veneer of legitimacy. The registrar remains unlisted in public WHOIS, suggesting private registration to hinder abuse takedown. No current listings appear on major blocklists (OpenPhish, PhishTank, URLVoid), and domain trust scores on VirusTotal and SecurityTrails hover near zero, reflecting the absence of historical reputation. Creation date is undetermined, but the lack of prior DNS history coupled with the subdomain’s recent minting indicates a campaign launched within the last 48–72 hours.

Mitigation is immediate: treat any link or QR code containing bridge-nav-get.zapier.app as hostile and do not interact. Verify any purported Zapier file-transfer via the official zapier.com domain using two-factor-authenticated sessions. Users should revoke any wallet approvals previously granted to this domain and revoke connected app permissions in wallet settings. Enterprise SOCs should block 64.239.123.1 at the firewall and hunt for beaconing to the domain across email, Slack, and browser telemetry channels.