faqhelp[.]zapier[.]app

This domain, faqhelp.zapier.app, is flagged for brand impersonation targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site mimics Ledger’s official support portal, using the page title 'Getting™ Started | Ledger®' to deceive users into interacting with fraudulent content. No explicit crypto drainer kit signatures were identified, but the domain’s infrastructure and impersonation tactics align with credential theft or wallet compromise campaigns. The threat type is classified as brand impersonation with elevated risk due to the targeted nature of the deception and potential financial impact on victims. Infrastructure analysis reveals the domain was registered through Name.com, Inc. on April 26, 2026, and resolves to the IP address 64.239.123.1. The domain is hosted on Amazon Web Services with content delivered via Amazon S3, and additional technologies detected include Vercel, Stripe, reCAPTCHA, and HSTS enforcement. Security vendor assessments on VirusTotal show 11 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing. The SSL certificate is issued by Let’s Encrypt, a common but non-exclusive indicator of legitimacy, often abused in phishing campaigns. As of the latest assessment, faqhelp.zapier.app has been taken offline, reducing immediate exposure risk. However, residual threats persist due to the domain’s recent activity and potential for re-emergence under similar infrastructure. Users who interacted with the site should assume credential exposure and take immediate action, including revoking wallet access, rotating passwords, and monitoring for unauthorized transactions. Organizations should block the domain and its resolving IP at the network level, and security teams should correlate logs for connections to 64.239.123.1 or requests to faqhelp.zapier.app to identify compromised endpoints. Ongoing vigilance is required, as threat actors frequently repurpose infrastructure for subsequent campaigns.