trezor-eng-start[.]square[.]site

On July 23, 2026, the domain trezor-eng-start.square.site was observed in an elevated‑risk brand‑impersonation campaign targeting users of the hardware wallet brand Trezor. The domain is registered through MarkMonitor, Inc., a registrar commonly used for legitimate brand protection, and was originally created on 5 February 2019. DNS resolution points to the IPv4 address 74.115.51.5, which belongs to AS27647 (Weebly, Inc.) in the United States. The hosting infrastructure leverages Amazon Web Services and is fronted by Cloudflare, as indicated by the detected technology stack and the four authoritative nameservers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns). An SSL certificate issued by Let’s Encrypt (certificate identifier E7) is present, confirming that TLS is active despite the site returning a HTTP 404 status code and a page title of “404 – Page Not Found”.

VirusTotal scans have flagged the domain on 14 of 95 security engines, and the domain appears on a single external blocklist, where it is actively blocked by PhishDestroy. The classification in the intelligence set labels the activity as a “Crypto Scam” that impersonates Trezor, although no additional payload or credential‑harvesting page content has been captured. The current offline status indicates that the site is not serving malicious content at the time of analysis, but the infrastructure components and detection history suggest a reusable template that could be re‑activated. Uncertainty remains around the exact attack vector: no login form, malicious payload, or phishing page has been observed, and the only publicly visible response is a 404 page.

Consequently, it is unclear whether the domain was used in a live campaign or remains dormant. Defenders should therefore treat the domain as a potential threat indicator. Recommended actions include adding the domain to internal blocklists, monitoring DNS queries for the IP address 74.115.51.