brdg-trazor-io[.]square[.]site

Analysis indicates that the domain brdg-trazor-io.square.site is actively hosting a brand‑impersonation page targeting Trezor users. The site presents the page title “Trezor Bridge | Hardware Wallet Integration Made Easy | Trezor‑Bridge”, suggesting an attempt to masquerade as an official Trezor integration service. The TLS certificate is issued by Let’s Encrypt (identifier YE2) and the server returns HTTP 200, confirming a functional web service. DNS resolution points to IP 74.115.51.5, an address associated with Weebly, Inc. in the United States, and the domain is registered through MarkMonitor Inc., a registrar commonly used by legitimate enterprises. The domain appears on three security blocklists and is flagged by PhishDestroy, MetaMask, and SEAL, reinforcing the malicious classification. VirusTotal reports four of ninety‑one scanners flag the domain, providing additional detection evidence. Nameserver delegation uses four AWS Route 53 name servers, a pattern frequently observed in cloud‑hosted abuse campaigns. No further page content has been disclosed, so the exact phishing workflow remains unverified. Defenders should block traffic to the domain and its resolved IP, add the host to internal threat intel feeds, and monitor for any outbound connections from internal assets to the listed AWS name servers. Continuous re‑scanning of the URL is advised to capture any evolution of the payload, and users of Trezor hardware should be alerted to the impersonation attempt.