auth-trezor-wallet-us[.]square[.]site

auth-trezor-wallet-us.square.site is a fraudulent domain designed to impersonate the legitimate Trezor cryptocurrency wallet service. This specific threat involves brand impersonation, where attackers mimic Trezor's branding and interface to deceive users into entering sensitive information such as wallet credentials, recovery phrases, or private keys. The page title 'Trezor Wallet Review 2025 – Features, Fees, How it' suggests a fake review page intended to appear trustworthy, while the subdomain 'auth-trezor-wallet-us' implies an authentication portal, further luring victims into a false sense of security.

Evidence from security analysis shows that VirusTotal flagged this domain with 4 out of 95 security vendors marking it as malicious, indicating moderate but concerning detection rates. The domain was registered on June 15, 2026 through MarkMonitor Inc., a reputable registrar, which may have delayed takedown actions. It appears on three security blocklists and resolves to IP address 74.115.51.4. The SSL certificate was issued by Let's Encrypt with identifier E8, a common choice for phishing sites due to its free and automated issuance. Fortunately, the site is currently marked as offline, suggesting it has been taken down following reports.

If users visited this domain, they should immediately change any passwords they may have entered and enable two-factor authentication on their Trezor accounts and associated email addresses. They should also monitor for unauthorized transactions or account access, and consider contacting Trezor support for further guidance. Running a security scan on their devices is recommended to check for malware or credential stealers. Users should always verify the authenticity of Trezor-related websites by navigating directly from the official Trezor website or using bookmarks, and avoid clicking on links from unsolicited emails or messages.