trezor-suiite[.]square[.]site

This domain, trezor-suiite.square.site, is actively engaged in cryptocurrency theft through a crypto drainer scheme. Analysis indicates it impersonates Trezor, a legitimate hardware wallet provider, to deceive users into connecting wallets and authorizing malicious transactions. The domain employs a typosquatting variant of the official Trezor Suite interface, likely leveraging a pre-built drainer kit to automate fund siphoning from compromised wallets. Infrastructure analysis reveals the domain resolves to IP address 74.115.51.5, hosted on AS27647 (Weebly, Inc.) in the United States. It was registered on February 05, 2019, through MarkMonitor Inc., a registrar commonly used for both legitimate and malicious domains. VirusTotal reports 2 out of 95 security vendors flagging this domain as malicious, while it appears on three independent security blocklists. The domain remains unlisted in Google Safe Browsing (GSB) at the time of this report, indicating potential gaps in automated detection coverage. Current status confirms the domain remains active, posing a high risk to users of cryptocurrency wallets. Response actions include submission to additional threat intelligence platforms and coordination with hosting providers for takedown. Despite partial detection by security vendors, the domain continues to operate, underscoring the need for manual verification of wallet connection prompts. Users are advised to validate domain authenticity via official sources before interacting with any wallet interface and to monitor connected wallet permissions for unauthorized access.