docs-trezr-en[.]square[.]site

This domain, docs-trezr-en.square.site, poses as an official Trezor hardware wallet interface to deceive users into entering sensitive credentials, such as recovery seeds or private keys. Brand impersonation attacks of this nature are designed to harvest cryptocurrency wallet access details, leading to unauthorized asset transfers and irreversible financial loss. The site mimics legitimate wallet management portals, often leveraging urgency or fake security alerts to manipulate victims into disclosing confidential information. Analysis indicates the domain was registered on February 5, 2019, through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. Security vendors flagged this domain as malicious, with 11 out of 95 engines on VirusTotal detecting it as a threat. Infrastructure analysis reveals the domain resolves to 74.115.51.4, hosted on AS27647 (Weebly, Inc.), a platform frequently exploited for phishing due to its ease of domain creation and hosting. The domain appears on two security blocklists and uses a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. If a user visited this domain or interacted with its content, immediate action is required. First, disconnect the device from the internet to prevent potential data exfiltration. Next, assume any entered credentials or recovery phrases are compromised and initiate recovery procedures for the affected wallet. Generate a new wallet address and transfer remaining assets to it using a verified, secure device. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams and consider notifying the impersonated brand to aid in takedown efforts.