appstrustcapital[.]zapier[.]app

PhishDestroy identifies appstrustcapital.zapier.app as a generic phishing domain currently under investigation for cryptocurrency-draining activity. The domain does not impersonate a specific brand but functions as a crypto drainer kit, designed to trick users into connecting wallets and silently transferring funds. No custom drainer kit signature has been extracted yet; the threat remains classified as generic due to deployment on a subdomain of zapier.app, which is leveraged for credibility masking. This subdomain strategy is frequently observed in short-lived campaigns targeting crypto users.

Technical analysis reveals this domain resolves to IP 64.239.123.193 and is served over a valid Let's Encrypt SSL certificate, increasing user trust. VirusTotal currently reports 14 out of 95 detection engines flagging the domain, indicating it is not yet widely recognized as malicious. The domain was registered recently and is hosted on infrastructure associated with dynamic content delivery services, which complicates attribution. Google Safe Browsing (GSB) has not yet listed this domain, and no public blocklist entries were detected at the time of analysis. These characteristics suggest an actively evolving campaign with low detection coverage.

As of current status, this domain remains active and poses a moderate-to-high risk to users interacting with financial prompts or wallet connections. PhishDestroy has flagged this domain with unique seed 8472d8 and is conducting further behavioral analysis to extract drainer payloads and campaign attribution. Users are strongly advised to avoid visiting appstrustcapital.zapier.app and verify any related links using PhishDestroy’s real-time scanning tool. The remaining risk is elevated due to low detection signatures and the use of reputable infrastructure (Zapier subdomain + Let's Encrypt), which can bypass traditional browser warnings. Continuous monitoring is in effect to update detection rules and blocklist entries.