webtrozirapp[.]zapier[.]app

Analysis indicates that the domain webtrozirapp.zapier.app was used for a brand‑impersonation campaign targeting Trezor users. The site presented the page title "Official Trezor™ Suite App," a clear reference to the legitimate Trezor Suite application, and was classified as a brand‑impersonation scam. The domain is registered through Name.com, Inc. and resolves to the IP address 64.239.109.1, which belongs to Amazon.com, Inc. (AS16509) and is hosted on Amazon Web Services with additional infrastructure components from Vercel, including Vercel DNS name servers ns1.vercel-dns.com and ns2.vercel-dns.com. The presence of Stripe, reCAPTCHA, HSTS, and Amazon S3 suggests that payment‑processing and anti‑bot services were provisioned, although the site returned an HTTP 404 status at the time of observation, indicating that the content was removed or never served.

The SSL certificate is issued by Let’s Encrypt under the YR1 identifier, providing encrypted transport but offering no indication of legitimacy. Security telemetry shows that PhishDestroy has blocked the domain, and VirusTotal recorded detections from 2 of 91 scanning engines, reflecting a low but non‑zero consensus among automated scanners. The domain appears on a single public blocklist and received a Gridinsoft trust score of 0 / 100, reinforcing its malicious classification.

Because the site is currently offline, direct forensic analysis of the landing page is not possible, leaving the exact content and credential‑harvesting mechanisms uncertain. Defenders should proactively block the domain and its associated IP address in network perimeter controls, update URL filtering policies, and monitor for any resurgence of the domain or related subdomains. Continuous observation of the hosting provider’s IP range is advised, as the infrastructure could be reused for future impersonation campaigns.