cloud-trezorio-en[.]square[.]site

This domain, cloud-trezorio-en.square.site, poses a significant threat as a brand impersonation scheme specifically targeting Trezor hardware wallet users. The site mimics the official Trezor setup process, using a nearly identical page title (*Trezor.io/Start | Starting® Up® Device® |Official | Trezor.io/start) to deceive visitors into believing they are interacting with legitimate Trezor infrastructure. Such impersonation sites typically aim to harvest seed phrases, private keys, or other sensitive authentication details, enabling attackers to drain cryptocurrency wallets or gain unauthorized access to user funds. The inclusion of registered trademark symbols (®) in the page title further demonstrates an attempt to lend false legitimacy to the fraudulent page. Analysis of the domain’s infrastructure reveals multiple high-confidence indicators of malicious activity. The domain was registered on June 15, 2026, through MarkMonitor Inc., a registrar often associated with both legitimate and malicious domains. It resolves to the IP address 74.115.51.5 and is currently flagged by 6 out of 95 security vendors on VirusTotal, including specialized blocklists such as MetaMask, PhishDestroy, and SEAL. Additionally, the domain appears on three separate security blocklists, and its SSL certificate, issued by Let’s Encrypt, does not mitigate the risk, as fraudulent sites commonly use valid certificates to appear trustworthy. The combination of these factors—recent creation date, blocklist presence, and vendor detections—confirms the domain’s role in a coordinated brand impersonation campaign. Users who visited cloud-trezorio-en.square.site should take immediate action to mitigate potential risks. First, disconnect any devices that interacted with the site and cease all further engagement. If any sensitive information, such as seed phrases or private keys, was entered, assume the credentials are compromised and transfer funds to a new, secure wallet immediately. Monitor all linked accounts for unauthorized transactions and enable additional security measures, such as multi-factor authentication, where available. Report the domain to relevant security teams or platforms to aid in broader threat mitigation efforts. Given the elevated risk level and confirmed malicious intent, users should treat any interaction with this domain as a critical security incident.