my-trezo-startio[.]square[.]site

my-trezo-startio.square.site is currently active and serves a page with the title “Trezor.io/start | The #1 Guide Hardware Crypto Wallet©”. The title directly references the Trezor brand, confirming the domain’s intent to impersonate the hardware wallet provider. Technical fingerprinting shows the site is hosted on Weebly infrastructure in the United States, resolves to IP 74.115.51.4, and is protected by a valid Let’s Encrypt certificate (issued to YE2). HTTP requests return status code 200, indicating the page is reachable.

DNS analysis reveals four Amazon Route 53 name servers (ns‑1248.awsdns‑28.org, ns‑1816.awsdns‑35.co.uk, ns‑311.awsdns‑38.com, and a fourth entry truncated in the source). The backend stack includes MySQL, PHP, Vue.js, reCAPTCHA, and HSTS, all typical of a Weebly‑based site. The domain was registered through MarkMonitor Inc., a registrar commonly used for legitimate brand protection, which suggests the registration may be an attempt to masquerade as an authorized asset. VirusTotal scans show five of ninety‑one security vendors flag the domain as malicious, and the domain appears on three external blocklists.

It is also listed as blocked by PhishDestroy, MetaMask, and SEAL, providing additional evidence of abusive activity. Current intelligence does not disclose the exact content of the landing page beyond the title, nor does it reveal any credential‑harvesting forms. Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the four associated name servers, and consider adding the IP address 74.115.51.4 to deny lists. Ongoing observation is recommended to detect any changes in content or additional infrastructure that could increase the threat surface.