started-lebger[.]zapier[.]app

PhishDestroy identifies a sophisticated Ledger wallet phishing campaign operating from the domain started-lebger.zapier.app. This fraudulent site specifically mimics the official Ledger wallet interface to deceive cryptocurrency users into entering their recovery phrases or private keys. The attackers leverage Zapier's app subdomain (zapier.app) to lend false credibility to the phishing page, creating a convincing replica that could easily trick users unfamiliar with domain verification processes. Once users input their sensitive credentials, the phishing system immediately harvests this data for unauthorized wallet access and fund theft. Security researchers note this particular campaign shows signs of automated credential harvesting with potential for large-scale wallet compromise.

This domain was flagged by PhishDestroy seed 149f31 with a VirusTotal detection rate of 12 out of 95 security engines, indicating it remains undetected by most antivirus solutions as of current analysis. The domain resolves to IP address 64.239.109.1, which hosts the phishing infrastructure through Let's Encrypt SSL certificates to appear legitimate. Research shows this particular phishing implementation has not yet appeared on major blocklists, suggesting rapid deployment designed to evade initial detection systems. The domain continues to operate actively despite containing obvious red flags like misspellings ('lebger' instead of 'ledger') in its construction.

Users who may have visited started-lebger.zapier.app should immediately transfer any remaining cryptocurrency assets to freshly generated wallets with new recovery phrases. Check all connected wallets for unauthorized transactions and revoke any permissions granted to suspicious applications. Consider enabling hardware wallet security for all crypto holdings and enable transaction confirmation alerts. Run a malware scan on all devices used for cryptocurrency transactions, as phishing sites often distribute additional malicious payloads. Report any unauthorized transactions to your wallet provider and relevant cryptocurrency authorities immediately while changing all related passwords and security credentials.