trezostartio[.]square[.]site

Analysis on July 19, 2026 indicates that the domain trezostartio.square.site is actively hosting a brand-impersonation campaign targeting Trezor. The site returns HTTP 200 and presents the page title “Trezor.io start | The #1 Advanced Hardware Wallet (Official)”, which aligns with the declared scam type. The domain resolves to IP 74.115.51.5, a server owned by Weebly, Inc. in the United States and is served with a valid Let’s Encrypt certificate (CN YE2). Registration details show MarkMonitor Inc. as the registrar. Authoritative name servers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and a fourth entry truncated in the source. The infrastructure has been listed on three security blocklists and is already blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show three of ninety‑one security vendors flagging the domain, confirming malicious classification. Risk level is marked high and the domain remains active. While the page title confirms the impersonation claim, no additional content has been examined, so the exact phishing payload or credential-capture mechanisms are not yet documented. Defenders should treat any traffic to this domain as malicious, add the domain to deny‑list rules, and monitor the associated IP and name‑server set for future use in related campaigns.