eexodus-web3[.]zapier[.]app

The domain eexodus-web3.zapier.app is currently active and associated with a crypto wallet drainer phishing campaign. This threat type involves malicious infrastructure designed to siphon cryptocurrency from victims by impersonating legitimate Web3 wallet interfaces or decentralized application (dApp) frontends. As of the latest analysis, the domain remains operational and has not been flagged by security vendors for malicious activity. Infrastructure analysis reveals that the domain is hosted on a subdomain of zapier.app, a legitimate automation platform, which may contribute to its evasion of detection. The domain resolves to the IP address 64.239.123.1, a host that has not been previously associated with widespread malicious activity. VirusTotal telemetry indicates zero detections out of 95 security vendors, suggesting the campaign is either new or employing evasion techniques to avoid automated flagging. No registrar details are available for the subdomain itself, as it is managed under Zapier's infrastructure. Additional blocklist checks confirm the domain has not been added to major threat intelligence feeds, further complicating early detection efforts. The current risk assessment indicates a targeted threat with potential for financial harm to users interacting with the domain. Organizations and individuals are advised to block the domain eexodus-web3.zapier.app and its resolving IP 64.239.123.1 at the network perimeter. End-users should exercise caution when engaging with Web3 applications, particularly those promoted via unsolicited links or social engineering tactics. Browser-based security extensions and endpoint protection tools should be updated to include this domain in custom blocklists. Continuous monitoring of subdomains under zapier.app and similar legitimate platforms is recommended, as attackers may leverage these services to bypass reputation-based defenses.