bridge-en-us[.]zapier[.]app

PhishDestroy identifies bridge-en-us.zapier.app as an active crypto drainer posing as a legitimate Zapier login portal. The domain presents an elevated risk due to its ongoing use in credential theft campaigns aimed at cryptocurrency users. This threat targets individuals expecting to authenticate with Zapier, redirecting stolen credentials to unauthorized wallets controlled by threat actors. Given the domain’s recent activity and high detection rates among security vendors, immediate caution is warranted to prevent unauthorized cryptocurrency transactions.

This domain was flagged by eight out of ninety-five VirusTotal security vendors, indicating widespread recognition of its malicious nature. Registered under Let’s Encrypt, bridge-en-us.zapier.app resolves to IP address 64.239.123.65 and has been blocked by PhishingArmy and OISD—two recognized security blocklists. The domain leverages a legitimate-looking subdomain structure to deceive users, a common tactic among crypto drainers that mimic trusted service interfaces. While specific creation and expiration dates are not provided in available intelligence, the combination of high detection rates, active blocklist inclusion, and SSL certification suggests a recently deployed but rapidly escalating threat vector.

To mitigate exposure, users should avoid clicking links from unsolicited emails or messages referencing Zapier authentication. Always verify the domain by manually typing zapier.com into your browser and logging in directly. Use multi-factor authentication (MFA) on all cryptocurrency-related accounts and monitor wallet transactions for unauthorized activity. Report any suspicious interactions involving this domain to PhishDestroy for further analysis and potential blacklisting. Staying vigilant against deceptive subdomains and validating URLs before inputting credentials can prevent falling victim to crypto drainer attacks.