home-iostart[.]zapier[.]app

This domain, home-iostart.zapier.app, is currently under investigation for operating as a cryptocurrency phishing site specifically targeting users of the Trézor hardware wallet. The page title, 'Official® | Trézor.io/Start®,' directly impersonates the legitimate Trézor onboarding portal, suggesting an intent to deceive users into divulging sensitive credentials or recovery seed phrases. Analysis indicates the site remains active and unflagged by most security vendors, increasing the risk of successful compromise for unsuspecting victims. Infrastructure analysis reveals the domain resolves to the IP address 64.239.123.1, with no prior blocklist history reported. As of the latest scan (seed 5fda8d), the domain has been flagged by 0 of 95 vendors on VirusTotal, indicating minimal detection at this stage. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites to evade browser security warnings. The domain is hosted under the zapier.app registrar, which provides a subdomain infrastructure often exploited for rapid deployment of phishing campaigns due to its low barrier to entry and perceived legitimacy. Current risk assessment categorizes this domain as high-threat due to its active status, targeted impersonation of a cryptocurrency wallet provider, and lack of widespread detection. Users are strongly advised to avoid interacting with the site and to verify the authenticity of any Trézor-related communications by accessing the official domain directly. Security teams should monitor for connections to the IP 64.239.123.1 and consider implementing network-level blocks to prevent potential credential harvesting. Immediate reporting to relevant security vendors is recommended to facilitate broader detection and mitigation.