trezor-io-start-sso-en[.]square[.]site

The domain trezor-io-start-sso-en.square.site has been identified as a high-risk brand impersonation threat, specifically targeting Trezor. This domain was set up to mimic the legitimate Trezor.io setup guide page, misleading users into believing they were accessing a trusted resource. Such impersonation can lead to significant security breaches, including the unauthorized access of user credentials or sensitive financial information.

The domain was registered through MarkMonitor Inc. and utilized a Let's Encrypt SSL certificate. It resolved to the IP address 74.115.51.5. Analysis from VirusTotal shows that 14 out of 95 security vendors have flagged this domain as potentially harmful. Despite being taken offline, it appeared on three security blocklists, including those maintained by MetaMask, PhishDestroy, and SEAL. The domain was created on June 15, 2026, indicating it was likely intended to be a long-term phishing resource.

Users who may have visited this domain should immediately change any passwords entered on the site and monitor their accounts for unauthorized activities. It is recommended to enable multi-factor authentication where possible. Additionally, users should remain vigilant for similar brand impersonation schemes and verify URL authenticity before entering sensitive information. Regularly updating security software and employing advanced threat protection tools can further mitigate the risks of such phishing attacks.