connect-trez-bridge[.]square[.]site

The domain connect-trez-bridge.square.site was created on February 5, 2019 and is currently listed as offline. It presents a page title of "Trezõr brïdge® | Connect Your Web3 World Securely™", explicitly referencing the Trezor brand, confirming a targeted crypto‑related impersonation. VirusTotal records indicate that 12 of 95 security vendors have flagged the domain, demonstrating moderate detection consensus across commercial scanners. Scamadviser assigns a trust score of 1 out of 100, reflecting an extremely low reputation. The site uses a Let’s Encrypt certificate (E7), which is typical for legitimate sites but does not mitigate the observed malicious intent.

DNS resolution points to IP address 74.115.51.4, which is registered to AS27647 (Weebly, Inc.) in the United States and is hosted on Amazon Web Services behind Cloudflare, a common infrastructure for both benign and malicious actors. The HTTP response returns a 404 status, indicating that the specific page is not presently serving content, which aligns with the reported offline state. The domain is registered through MarkMonitor, Inc., a registrar often used by legitimate enterprises, suggesting possible compromise of a legitimate registration channel or abuse of a reseller. The site has been blocked by the PhishDestroy community and appears on one security blocklist, reinforcing its classification as a crypto scam.

Nameservers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-810.awsdns, all pointing to AWS DNS services. Defenders should immediately add the domain and its resolved IP address to network deny lists, monitor the IP for any re‑hosting activity, and watch for re‑registration of similar subdomains under the square.site TLD. Continuous threat‑intel feeds should be consulted for any resurgence, and endpoint security solutions that reference the VirusTotal detection count should be updated to ensure the domain is treated as malicious.