home-faqs-trezr-io[.]square[.]site

The domain home-faqs-trezr-io.square.site has been identified as a high-risk brand impersonation infrastructure specifically designed for credential theft targeting cryptocurrency wallet users. This domain is currently offline but previously impersonated Trezor, a well-known hardware wallet provider, with the intent to harvest login credentials or deploy crypto drainer malware. Analysis of the domain reveals multiple technical indicators confirming malicious intent. The domain was created on June 15, 2026, and registered through MarkMonitor Inc., a registrar commonly used for both legitimate and malicious domains. It resolved to the IP address 74.115.51.5 and used a Let's Encrypt SSL certificate (serial number E8), which is frequently exploited by threat actors due to its low barrier to entry. Security vendors flagged the domain in 14 of 95 VirusTotal scans, and it appeared on three distinct security blocklists. The page title, 'Trezor Access Portal™ | Official Trezor® Login for Safe Trading,' closely mimics legitimate Trezor branding to deceive users into entering sensitive information. As of the latest verification, the domain has been taken offline, likely due to enforcement actions or infrastructure changes by the threat actor. However, the risk remains for users who may have interacted with the domain prior to its removal. Organizations and individuals are advised to block the domain and its associated IP address at the network level, revoke any credentials entered on the site, and monitor for unauthorized transactions. Users should verify the authenticity of cryptocurrency-related websites by cross-referencing official domains and enabling multi-factor authentication on all accounts. Security teams should treat this domain as part of a broader credential theft campaign targeting cryptocurrency users.