livewalet-ldgr[.]zapier[.]app

This domain, livewalet-ldgr.zapier.app, is identified as a credential harvesting phishing site designed to impersonate financial service platforms and steal user authentication credentials. Analysis indicates the threat type is highly targeted, focusing on capturing login details through fraudulent forms labeled 'New form.' The domain is currently offline, but prior activity suggests it was operational for malicious data collection. Infrastructure analysis reveals the domain was registered through Name.com, Inc. and resolved to IP address 64.239.123.1. It is flagged by 10 of 95 security vendors on VirusTotal, indicating broad detection across the security community. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, reflecting its confirmed malicious status. Detected technologies include Amazon Web Services, Vercel, Stripe, reCAPTCHA, HSTS, and Amazon S3, which were likely leveraged to create a deceptive, functional facade. The SSL certificate is issued by Let's Encrypt, a common tactic used to lend false legitimacy to phishing sites. Current status shows the domain has been taken offline, likely in response to detection and blocking by security systems. However, the infrastructure and techniques observed suggest potential for re-emergence under a different domain or subdomain. Organizations and users are advised to block the domain and its associated IP address 64.239.123.1 at the network level. Security teams should monitor for similar subdomains under zapier.app or other integration platforms, as these are frequently abused for phishing campaigns. Users who may have interacted with this domain should reset credentials immediately and enable multi-factor authentication on all financial and sensitive accounts. Network logs should be reviewed for connections to 64.239.123.1 to identify any compromised systems.