service-trezor[.]zapier[.]app

This domain, service-trezor.zapier.app, is confirmed to host a fake login portal impersonating Trezor, a cryptocurrency hardware wallet provider. The page presents itself as the "Official Trezor™ Login," designed to harvest credentials from users attempting to access their crypto wallets. Such impersonation schemes typically aim to facilitate unauthorized access to wallets, leading to potential theft of cryptocurrency assets or installation of malicious software like crypto drainers. The threat is classified as brand impersonation with an elevated risk level due to the direct targeting of financial assets and the high likelihood of user deception through mimicked branding and login interfaces. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain is flagged by 21 out of 95 security vendors on VirusTotal, indicating broad consensus on its fraudulent nature. It is registered through Name.com, Inc., a registrar commonly used for both legitimate and malicious domains. Infrastructure analysis shows the domain resolves to the IP address 64.239.109.129, and it is currently listed on one security blocklist. The SSL certificate is issued by Let's Encrypt (R13), a common provider for both benign and malicious sites, which does not mitigate the domain's inherent risk. The domain has since been taken offline, but its prior activity and infrastructure remain a concern for retrospective analysis. Users who visited service-trezor.zapier.app or entered credentials on the site should assume their login details have been compromised. Immediate steps include revoking any active sessions on legitimate Trezor platforms, enabling multi-factor authentication if not already active, and monitoring wallet addresses for unauthorized transactions. If cryptocurrency was accessed or transferred while logged into this domain, users should treat their wallets as compromised and consider migrating assets to new, secure wallets. Additionally, users should scan their devices for malware, as fake login portals often distribute secondary payloads. Reviewing browser extensions and installed applications for unauthorized or suspicious software is also recommended to mitigate further risk.