started-appen[.]zapier[.]app

This domain, started-appen.zapier.app, is classified as a brand impersonation threat specifically targeting the Trezor cryptocurrency hardware wallet brand. The page title displayed is 'Trézor.io/Start Device | Trezor®', which mimics the legitimate Trezor device setup interface. No specific drainer kit has been identified, but the domain is designed to harvest credentials or sensitive information from users attempting to initialize a Trezor device.

Technical indicators show a VirusTotal detection rate of 18 out of 95 security vendors flagging this domain as malicious. The domain resolves to IP address 64.239.123.193. Registration details are not directly provided, but the SSL certificate is issued by Let's Encrypt, commonly used in fraudulent campaigns. Google Safe Browsing status is not explicitly stated, but the elevated risk level and active status indicate potential in-the-wild distribution. The infrastructure leverages Amazon Web Services, Vercel, Stripe, reCAPTCHA, HSTS, and Amazon S3, suggesting a sophisticated hosting setup to evade detection.

Current status remains active, posing a continued risk to users. Recommended response actions include blocking the domain at the network level, reporting it to security vendors and hosting providers (AWS, Vercel) for takedown, and warning users against interacting with the site. Remaining risk is high due to the domain's active status and use of legitimate services like reCAPTCHA and Stripe to appear trustworthy.