trzr-sute-doc[.]square[.]site

The domain trzr-sute-doc.square.site is identified as a high-risk brand impersonation threat specifically targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates this domain was designed to mimic the official Trezor Suite initialization process, as evidenced by the page title 'Trezor.io/Suite | Initialize Your Trezor & Install Suite.' The domain is currently offline, but prior activity suggests it was operational for malicious purposes, likely to harvest credentials or distribute malicious software under the guise of legitimate wallet management tools. Infrastructure analysis reveals the domain resolved to the IP address 74.115.51.4 and was registered through MarkMonitor Inc. on June 15, 2026. Detection metrics indicate the domain was flagged by 14 of 95 security vendors on VirusTotal, a notable indicator of malicious intent. Additionally, the domain appears on three security blocklists and was proactively blocked by multiple cryptocurrency security providers. The SSL certificate was issued by Let’s Encrypt, a common practice among threat actors to lend superficial legitimacy to phishing pages. Current status confirms the domain has been taken offline; however, the risk of similar impersonation attempts persists. Users and organizations are advised to verify domain authenticity by cross-referencing with official sources before interacting with any cryptocurrency-related services. Network administrators should monitor for connections to the IP address 74.115.51.4 and domains registered through MarkMonitor Inc. with anomalous creation dates. Proactive blocking of domains flagged by multiple security vendors is recommended to mitigate potential exposure to brand impersonation threats.