startofficial-trezo-io[.]zapier[.]app

PhishDestroy identifies startofficial-trezo-io.zapier.app as an active credential theft phishing domain designed to harvest user login credentials under the guise of a legitimate service. The domain leverages the trusted 'zapier.app' subdomain to appear authentic while hosting a fraudulent login page that captures submitted credentials for malicious use. Threat actors frequently abuse cloud app subdomains like Zapier to bypass email security filters and social engineering defenses, making this campaign particularly effective against users expecting legitimate integrations.

This domain was flagged by 13 out of 95 VirusTotal security vendors, blocked by PhishingArmy and OISD blocklists, and resolves to IP 64.239.123.193. The SSL certificate issued by Let's Encrypt suggests an attempt to establish trust via HTTPS, despite the domain's malicious purpose. The active status combined with multiple blocklist detections indicates ongoing malicious operations rather than a newly registered or abandoned domain.

Users who visited startofficial-trezo-io.zapier.app should immediately change any credentials entered on the site, enable multi-factor authentication on all affected accounts, and scan devices for malware using updated antivirus software. Report the domain to your email provider and security team to help prevent further propagation. Avoid interacting with similar domains claiming to be official service integrations without independent verification through official channels.