trezr-suite[.]square[.]site

This domain, trezr-suite.square.site, poses a high-risk threat by impersonating the official Trezor Suite interface, a cryptocurrency wallet management platform. Analysis indicates the site is designed to deceive users into entering sensitive wallet credentials or recovery phrases, enabling unauthorized access to crypto assets. The page title, 'Trezor Suite – Manage Your Crypto Securely,' directly mimics the legitimate service, increasing the likelihood of successful social engineering attacks against Trezor users. Infrastructure analysis reveals the domain was registered on June 15, 2026, through MarkMonitor Inc., a registrar commonly associated with both legitimate and malicious domains. The domain resolves to the IP address 74.115.51.4 and is currently flagged by 14 out of 95 security vendors on VirusTotal, with detections from MetaMask, PhishDestroy, and SEAL. Additionally, the domain appears on three security blocklists, further corroborating its malicious intent. The SSL certificate issued by Let's Encrypt provides a false sense of security, as it does not validate the legitimacy of the site's content. Users who visited trezr-suite.square.site should immediately revoke any permissions granted to the site within their wallet applications. If credentials or recovery phrases were entered, affected wallets must be considered compromised, and all assets should be transferred to a new, secure wallet. Users are advised to monitor their wallet activity for unauthorized transactions and report the incident to relevant security teams. Blocking the domain and associated IP address (74.115.51.4) at the network level is recommended to prevent further exposure.