ldger-starts[.]zapier[.]app

This domain, ldger-starts.zapier.app, is flagged as a generic phishing resource targeting cryptocurrency hardware wallet users. Analysis indicates the site impersonates Ledger, a well-known manufacturer of secure crypto storage devices, to deceive victims into submitting sensitive recovery phrases or private keys. The page title 'New form' suggests a data collection interface designed to harvest credentials under false pretenses. No specific drainer kit signatures were identified, but the domain's structure and hosting on a legitimate automation platform (zapier.app) are consistent with phishing tactics aimed at bypassing initial user suspicion. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to IP address 64.239.109.1 and was registered through Name.com, Inc. on April 14, 2026, an unusually forward-dated registration likely intended to evade immediate detection. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), providing HTTPS encryption that may further mislead users into trusting the fraudulent site. As of the latest assessment, ldger-starts.zapier.app has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure remains registered and could be reactivated or repurposed for similar attacks. Users who interacted with the site should assume credential compromise and take immediate action, including revoking access to any linked wallets and monitoring for unauthorized transactions. The elevated risk level persists due to the domain's prior use and the persistent threat of phishing campaigns targeting cryptocurrency holders.