find-trezo-bridge[.]square[.]site

Analysis of the domain find-trezo-bridge.square.site, registered through MarkMonitor Inc., indicates active brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The domain resolves to IP address 74.115.51.4, hosted under Weebly, Inc. infrastructure in the United States, with nameservers managed by AWS (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-719.awsdns-25.net). The page title, 'Trezor Bridge | Connect Your Trezor Wallet Securely,' directly mimics official Trezor communication channels, suggesting an intent to deceive users into interacting with fraudulent wallet connection prompts. As of July 19, 2026, the domain remains active with an HTTP 200 status, and its SSL certificate is issued by Let's Encrypt (identifier YE2). Security vendor detection on VirusTotal shows 4 of 91 engines flagging the domain, while three independent blocklists—PhishDestroy, MetaMask, and SEAL—have classified it as malicious. The combination of brand-specific phrasing, active hosting, and partial vendor detection supports a high-risk classification. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related services are accessed. Given the domain's association with a known brand and its presence on multiple blocklists, user awareness campaigns should emphasize verifying official Trezor URLs before entering credentials or connecting wallets. Further investigation into the site's backend behavior is recommended to assess potential credential harvesting or wallet-draining mechanisms.