trezor-log-usa-guide[.]square[.]site

The domain trezor-log-usa-guide.square.site impersonates Trezor, a well-known cryptocurrency hardware wallet brand, to conduct credential phishing attacks. It was flagged by 16 out of 91 vendors on VirusTotal, indicating a significant level of malicious activity. The domain has been taken offline, but its prior activity posed a substantial threat to users attempting to access their Trezor accounts.

Registered through MarkMonitor, Inc. and hosted by Weebly, Inc. in the United States, the site used a Let's Encrypt SSL certificate to appear legitimate. The phishing page's title, "Crypto with Trezor Login – Start Now at Trezor.io/start® | trezor," was designed to lure users into entering their login credentials by mimicking the official Trezor website.

PhishDestroy, along with MetaMask and SEAL, included the domain on public blocklists, reflecting the coordinated effort to mitigate its impact. The domain's platform risk score of 80/100 further underscores the potential danger it posed before being taken down. Despite its offline status, the case highlights the ongoing need for vigilance against credential phishing schemes targeting cryptocurrency users.