us-trrezr-iostrt-app[.]square[.]site

This domain operates as a crypto asset drainer, designed to intercept and divert cryptocurrency transactions to attacker-controlled wallets. Analysis indicates the infrastructure is configured to masquerade as legitimate payment portals, tricking users into approving fraudulent transactions that authorize fund transfers without their knowledge. The site leverages deceptive domain structures and impersonation tactics to appear authentic, posing significant financial risk to visitors engaging with cryptocurrency-related services through this interface.

Analysis confirms this domain (us-trrezr-iostrt-app.square.site) was registered on February 05, 2019, through MarkMonitor Inc., a domain registrar often associated with enterprise-level domain management but misused in this case for fraudulent hosting. Infrastructure analysis reveals the site resolves to IP address 74.115.51.4, a known hosting environment linked to malicious activities targeting digital asset transactions. Security vendor assessments via VirusTotal indicate detection by 14 out of 95 scanning engines, classifying this as a high-risk threat with active compromise indicators. The domain’s age and consistent hosting configuration suggest prolonged malicious use without takedown intervention.

If you have visited this domain, immediately review your cryptocurrency wallet transaction history for unauthorized transfers or approvals. Revoke any suspicious transaction approvals through your wallet interface, particularly if you connected or interacted with the site. Disconnect any associated devices from network access and consider transferring remaining funds to a newly generated wallet address. Report the incident to relevant financial authorities or blockchain monitoring services, and avoid reusing wallet credentials or seed phrases across different platforms. This domain remains active; exercise caution and verify all transaction endpoints before approval.