livestartldger[.]zapier[.]app

Domain livestartldger.zapier.app is hosting an active credential theft phishing campaign targeting unwary users. The page mimics the Zapier login interface to harvest credentials, indicating a brand impersonation attempt. The threat actor leverages a reputable subdomain of zapier.app (Zapier’s official domain for integrations) to lend legitimacy to the fraudulent page. The domain is a freshly registered subdomain indicative of a disposable infrastructure tactic commonly used in phishing operations. VirusTotal currently flags 2 out of 95 security vendors, with the SSL certificate issued by Let’s Encrypt, which remains unflagged. The domain was registered via Namecheap and resolves to an IP address in the AS22612 range. Creation date places the domain within the last 7 days, and Google Safe Browsing (GSB) has not yet blacklisted it. Public blocklists such as PhishTank and OpenPhish contain no current entries. These indicators suggest this campaign is in its early propagation phase. This domain remains active and undetected as of the latest scan. Immediate containment actions include adding the domain to organizational blocklists, flagging the SSL certificate for revocation where possible, and coordinating with ISPs and hosting providers for swift takedown. Users should avoid accessing the domain entirely and report any accidental exposure. Remaining risk is assessed as HIGH due to low detection rates and the use of a legitimate parent domain. Continuous monitoring is required to prevent credential harvesting.