trezor-suite-apps[.]square[.]site

This domain, trezor-suite-apps.square.site, is flagged for brand_impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The site mimics the official Trezor Suite application, presenting itself as a legitimate desktop and web crypto management platform. Analysis indicates no direct evidence of a drainer kit, though the infrastructure aligns with typical cryptocurrency phishing campaigns designed to harvest credentials or private keys from unsuspecting users.

Infrastructure analysis reveals the domain was registered on June 15, 2026, through MarkMonitor Inc. and resolves to the IP address 74.115.51.4. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites. Security vendors on VirusTotal flagged the domain at a rate of 18/95, while it appears on three independent security blocklists. The domain is not currently listed in Google Safe Browsing, though it is actively blocked by multiple threat intelligence platforms, including PhishDestroy, MetaMask, and SEAL.

As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, residual threats persist due to the domain's prior distribution and potential caching in search engines or local DNS resolvers. Users who may have interacted with the site are advised to revoke any associated wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators to prevent future access attempts.