sso-trezor-secure-us[.]square[.]site

The domain sso-trezor-secure-us.square.site has been identified as a high-risk crypto drainer. This domain appears to impersonate a legitimate brand, potentially Trezor, to lure victims into providing sensitive information such as cryptocurrency wallet credentials. The threat actor may be utilizing a custom drainer kit to automate the theft of user data and cryptocurrency.

Infrastructure analysis reveals that sso-trezor-secure-us.square.site has a VirusTotal detection score of 2/95, indicating that while a majority of security vendors have not flagged it, some reputable sources recognize its malicious nature. The domain is registered through MarkMonitor, Inc., and resolves to the IP address 74.115.51.4, which is located in the United States and is part of the AS27647 Weebly, Inc. network. The domain was created on February 05, 2019, and currently appears on three security blocklists, further corroborating its malicious status. The domain is also blocked by PhishDestroy, MetaMask, and SEAL, which are known for their effectiveness in identifying and mitigating such threats.

The domain remains active, posing a significant risk to users who may fall victim to its deceptive tactics. Immediate response actions include adding the domain to security blocklists, configuring network firewalls to block traffic to and from this IP, and educating users about the dangers of crypto drainers. Despite these actions, the domain's continued activity and its low VirusTotal score suggest that the threat is not yet widely recognized, leaving a residual risk for unsuspecting users.