started-io-trexors[.]zapier[.]app

This domain is an active impersonation of the legitimate Trézor cryptocurrency wallet initialization portal, designed to harvest user credentials and seed phrases. Analysis indicates the site mimics the official Trézor.io/Start page, a critical entry point for wallet setup, where users typically input sensitive recovery information. The fraudulent domain leverages this trust to execute credential theft, potentially leading to unauthorized access and asset drainage from connected wallets. The threat is particularly severe for users unfamiliar with official domain structures, as the fake page replicates branding, layout, and even the use of registered trademark symbols (®) to appear authentic. Infrastructure analysis reveals the domain started-io-trexors.zapier.app is hosted on IP address 64.239.109.65 and is flagged by 16 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The domain is currently active and resolves to the aforementioned IP, which has been associated with other phishing campaigns targeting cryptocurrency users. While registrar details and creation date are not explicitly provided, the use of a subdomain under zapier.app suggests an attempt to exploit a legitimate service to bypass initial scrutiny. The page title, 'Trézor.io/Start® - Official®,' further confirms the intent to deceive users into believing they are interacting with the genuine Trézor setup process. Users who have visited this domain or entered credentials on the site should immediately revoke access to any connected wallets and transfer assets to a new, secure wallet. It is critical to reset all passwords and recovery phrases associated with the compromised account, as the attackers may have captured this information. Additionally, users should monitor their devices for unauthorized applications or extensions and run a full security scan to detect potential malware. To prevent future incidents, users are advised to verify domain authenticity by cross-referencing with official sources, such as the legitimate Trézor website, and to enable multi-factor authentication where available. Any suspicious activity should be reported to relevant security teams and blockchain monitoring services to aid in tracking and mitigating the threat.