comstarts-ledgo[.]zapier[.]app

On July 29, 2026 the analyst team recorded the domain comstarts-ledgo.zapier.app as an active generic phishing infrastructure. The domain was first registered on September 20, 2022 through Name.com, Inc. and is served by Vercel DNS with authoritative name servers ns1.vercel-dns.com and ns2.vercel-dns.com. DNS resolution points to the single IPv4 address 64.239.109.129, which is the only hosting endpoint observed. The IP belongs to a cloud hosting environment commonly used for temporary malicious sites; no additional services or sub‑domains were identified in public records.

Reputation checks show that the domain is listed on one security blocklist and has been explicitly blocked by the PhishDestroy sinkhole. VirusTotal scans report that 14 out of 91 antivirus and URL‑reputation engines flag the domain as malicious, reinforcing the classification as a phishing resource. No further public intelligence such as Safe Browsing status, OTX tags, SSL certificate details, or HTTP response codes were available at the time of analysis, leaving those vectors unverified. The combination of a recent creation date, reliance on a generic Vercel hosting stack, and the presence on multiple vendor blocklists suggests a deliberately short‑lived infrastructure designed to host credential‑stealing pages.

Because the underlying site content has not been harvested, defenders cannot confirm the exact brand or service being spoofed, and the lack of a captured page title or HTTP payload limits attribution. Recommended mitigation steps include adding the domain to local deny lists, updating proxy and DNS filtering rules to block both the domain and its resolving IP, and monitoring for any newly observed sub‑domains that resolve to the same address. Incident response teams should also query the IP for any related activity in recent logs and consider sharing the indicator set with upstream threat‑sharing platforms to accelerate community awareness.