started-trezrs[.]zapier[.]app

started-trezrs.zapier.app is an active crypto drainer phishing domain impersonating Trezor wallet login interfaces to steal cryptocurrency assets. This domain resolves to IP 64.239.109.1 and leverages a Let's Encrypt SSL certificate to appear legitimate, tricking users into entering seed phrases or private keys. The infrastructure is designed to harvest sensitive credentials and drain connected wallets immediately upon submission. PhishDestroy identifies this domain as part of a growing campaign targeting cryptocurrency users through deceptive redirection and spoofed interfaces.

This domain was flagged by PhishingArmy and OISD, two reputable threat intelligence blocklists, indicating confirmed malicious activity. According to VirusTotal analysis, 18 out of 95 security vendors have detected this domain as malicious. The domain is registered under the Zapier.app subdomain, likely leveraging Zapier’s trusted domain reputation to bypass initial scrutiny. While the exact creation date is not provided, the combination of active phishing behavior, multiple blocklist detections, and low detection coverage (only 18/95) suggests a recently deployed or evasive campaign. The use of a legitimate SSL certificate further increases the risk of successful user deception, as victims may overlook security warnings.

Users who have visited started-trezrs.zapier.app should immediately assume their credentials or seed phrases may have been compromised. If any cryptocurrency wallet credentials were entered on this site, users must transfer remaining funds to a new wallet with a fresh seed phrase immediately. Enable two-factor authentication on all associated accounts and monitor for unauthorized transactions. Run a full antivirus scan and consider revoking any API keys or permissions granted to suspicious domains. For further verification, users can check this domain’s status on PhishDestroy before interacting with it again.