trezu-en-web[.]square[.]site

The domain trezu-en-web.square.site was identified as a brand impersonation phishing site specifically targeting Trezor, a popular cryptocurrency hardware wallet brand. This domain, now taken offline, posed as a legitimate Trezor support page with the title "Trezor.io/Start® | Starting Up Your Device | Trezor®" to deceive users into connecting their wallets and ultimately draining their cryptocurrency. The threat type is a crypto drainer, where victims are tricked into providing sensitive information or signing malicious transactions.

Security analysis reveals that this domain was flagged by 8 out of 95 VirusTotal vendors, indicating moderate detection across security engines. It appeared on 3 security blocklists and was hosted on IP address 74.115.51.5. The domain was registered through MarkMonitor Inc., a legitimate registrar often abused by phishers, and was created on June 15, 2026. The SSL certificate was issued by Let's Encrypt with identifier E8, which is commonly used by both legitimate and malicious sites. The elevated risk level is due to the specific targeting of Trezor users, who are at high risk of losing their cryptocurrency if they fall for the scam.

As the domain has been taken offline, immediate risk to users is reduced, but similar domains may appear. Users who have interacted with trezu-en-web.square.site should take immediate action: revoke any permissions granted, move funds to a new wallet, and run a security scan on their devices. Always verify the authenticity of Trezor-related sites by visiting only the official Trezor website directly. For further verification and to report similar threats, consult PhishDestroy's database. Stay vigilant against phishing attempts that mimic legitimate cryptocurrency services.