homeledger[.]zapier[.]app

homeledger.zapier.app is a subdomain of zapier.app. PhishDestroy first observed the hostname on Aug 10, 2026. Stored content metadata identifies Across as the apparent target. The captured page title is “Official Ledger.com/Start”. Page analysis recorded additional brand references to Ethereum, Foundation, Ledger, and Solana. Stored page analysis classifies the content as seed phrase theft. Current evidence score: 95/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and URLScan. VirusTotal recorded 20 detections among 91 engines: alphaMountain.ai, BitDefender, Cluster25, CRDF, CyRadar, Ermes, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, Netcraft, OpenPhish, Sophos, VIPRE, Webroot on Aug 18, 2026 at 23:27 UTC. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Ledger and assigned phishing as its category on Aug 10, 2026 at 23:08 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 19, 2026 at 02:20 UTC. Google Safe Browsing returned no flag on Aug 18, 2026 at 23:27 UTC.

The collector marked the hostname reachable on Aug 11, 2026 at 22:52 UTC, but did not retain the HTTP response code. At collection time, the hostname resolved to 64.239.109.129 on AS16509 (AMAZON-02 - Amazon.com, Inc., US). The IP and ASN identify shared Vercel edge infrastructure; the origin server is not established by this address. DOM analysis on Aug 10, 2026 at 18:22 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Sep 19, 2026; checked Aug 10, 2026 at 19:02 UTC.

The content indicators and 2 positive source findings support the current Across-themed seed phrase theft classification.