login-trezorr-hub[.]square[.]site

This domain is a confirmed brand impersonation site designed to deceive users of Trezor, a hardware cryptocurrency wallet provider. The site mimics legitimate Trezor login portals to harvest credentials or facilitate unauthorized transactions, potentially leading to account takeovers or asset theft. The threat is particularly insidious as it leverages the trust associated with the Trezor brand to exploit victims, often through phishing emails or malicious advertisements directing users to the fraudulent domain.

Analysis indicates the domain login-trezorr-hub.square.site was registered on February 05, 2019, through MarkMonitor Inc., a registrar commonly used for both legitimate and malicious purposes. Despite its age, the domain remains active and resolves to the IP address 74.115.51.5, hosted on AS27647 (Weebly, Inc.) infrastructure in the United States. As of the latest scan, the domain has not been flagged by VirusTotal (0/95 detections), though it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The lack of VirusTotal detections may suggest evasion techniques or recent activation of malicious behavior.

Users who have visited login-trezorr-hub.square.site should assume their credentials or sensitive information may have been compromised. Immediate actions include revoking access to any connected cryptocurrency wallets or accounts, enabling multi-factor authentication where available, and monitoring for unauthorized transactions. If wallet recovery phrases or private keys were entered, users must transfer assets to a new, secure wallet and consider the original wallet compromised. Additionally, affected individuals should review their systems for malware, as brand impersonation sites often distribute malicious payloads. Blocking the domain and associated IP (74.115.51.5) at the network level is recommended to prevent further exposure.