support-trezorstart-cdn[.]square[.]site

support-trezorstart-cdn.square.site was observed hosting a page whose title mimics the official Trezor onboarding URL, indicating a targeted brand‑impersonation campaign aimed at crypto users. The domain resolves to 74.115.51.4, an address registered to AS27647 (Weebly, Inc.) in the United States and served through Amazon Web Services and Cloudflare. The site presented a valid TLS certificate issued by Let’s Encrypt (E7) and used four AWS‑provided nameservers (ns-810.awsdns-37.net, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and a fourth entry truncated in the source data). The registrar listed is MarkMonitor, Inc., a common registrar for high‑profile brand domains, suggesting the attackers deliberately chose a reputable registrar to increase perceived legitimacy.

VirusTotal scans returned 16 positive detections out of 93 scanners, and the domain has been added to at least one public blocklist and flagged by the PhishDestroy sinkhole, confirming that multiple security vendors consider it malicious. The HTTP response is currently a 404, and the domain status is marked offline, indicating that the phishing infrastructure has been taken down or is no longer serving content. The page title explicitly references “Trezor.io/Start | Starting® Up® Your® Device®,” reinforcing the targeted brand impersonation. No additional page content, screenshots, or form captures have been published, leaving the exact credential‑harvesting mechanism unknown.

Defenders should continue to block the domain at perimeter filters, add the associated IP address and its AS to network‑level deny lists, and monitor for any resurgence of similar AWS/Cloudflare‑hosted infrastructure that references Trezor branding. Indicators such as the Let’s Encrypt certificate fingerprint, the specific nameserver set, and the 16 VirusTotal detections can be leveraged for threat‑intel sharing.