trezor-bridge-learn[.]square[.]site

Analysis dated July 19 2026 flags trezor-bridge-learn.square.site as an active brand‑impersonation infrastructure targeting Trezor users. The domain resolves to the IPv4 address 74.115.51.5, which is geolocated to the United States and is hosted by Weebly, Inc. Authoritative name servers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, indicating reliance on Amazon Route 53 DNS services. Registration details list MarkMonitor Inc. as the registrar, a provider commonly used for legitimate brand domains, suggesting possible abuse of a compromised or mis‑configured account. The site presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier YE2) and returns HTTP 200, confirming that the web service is reachable and serving content. The page title “Trezor Bridge for Windows & Mac | Official Setup Guide | trezor bridge” directly references the Trezor brand, reinforcing the impersonation claim. VirusTotal scans have recorded 14 detections out of 91 scanners, and the domain is currently listed on three public blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple threat‑intelligence feeds have observed malicious activity. While the exact payload or credential‑harvesting mechanism has not been publicly disclosed, the convergence of brand‑specific wording, a functional TLS endpoint, and multiple detections suggests a high‑risk phishing campaign. Defenders should add the domain and its resolved IP address to deny‑list rules, monitor DNS queries for the listed name servers, and enforce email and web filtering that blocks URLs containing “trezor‑bridge‑learn.square.site”. Continuous re‑scanning of the site is advised to capture any changes to the hosting or content.