portal-trezoriostart-web[.]square[.]site

This domain, portal-trezoriostart-web.square.site, presents a high-risk brand impersonation threat targeting users of the Trezor hardware wallet. The site mimics the official Trezor.io/start onboarding portal, tricking victims into entering recovery seeds or private keys under the guise of accessing the Trezor Suite App. Analysis of the page title—'Trezor.io/Start® | Trezor Suite App (Official) | Trezor® | Trezor.io/start'—reveals deliberate use of official branding elements, including registered trademark symbols, to lend credibility to the fraudulent operation. The threat is designed to facilitate cryptocurrency theft by capturing sensitive credentials, which are then used to drain wallet balances or transfer assets to attacker-controlled addresses.

Technical indicators confirm the malicious nature of this domain. The domain was registered on June 15, 2026, through MarkMonitor Inc., a registrar commonly associated with legitimate brands but also abused for impersonation campaigns. It resolves to the IP address 74.115.51.5 and uses a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the site. As of the latest scan, 15 out of 95 security vendors on VirusTotal flag this domain as malicious. Additionally, the domain appears on three security blocklists and is proactively blocked by multiple browser-based security tools, further corroborating its classification as a high-risk threat.

Users who have visited portal-trezoriostart-web.square.site or entered sensitive information on the site should take immediate action to mitigate potential losses. First, revoke any active sessions or authorizations granted to the fraudulent site via wallet interfaces or connected applications. Next, initiate a full security audit of all associated wallets, checking for unauthorized transactions or changes to recovery phrases. If credentials were exposed, transfer assets to a new, secure wallet using a clean device to prevent further compromise. Monitor account activity closely and report the incident to relevant security teams or threat intelligence platforms to contribute to broader defensive efforts.