guide-trezoriostart-en[.]square[.]site

The domain guide-trezoriostart-en.square.site is currently active and hosts a page titled “Trezor Setup — Trezor.io/Start | Official Setup Guide® | Trezor.io/start”. The content mimics the official Trezor onboarding flow, indicating a brand‑impersonation campaign aimed at deceiving users seeking a hardware wallet setup. Infrastructure analysis shows the domain resolves to IP 74.115.51.4, an address owned by AS27647 Weebly, Inc. in the United States. The site is built on a Weebly front‑end with MySQL, PHP, Vue.js, HSTS, Cookiebot, and is fronted by Cloudflare. The TLS certificate is issued by Let’s Encrypt (E8) and is currently valid. Security telemetry reports that two out of ninety‑five VirusTotal scanners have flagged the domain, and it appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. The domain was created on February 5, 2019 and uses four AWS name servers. Defenders should block guide-trezoriostart-en.square.site at network perimeters and email gateways, and add it to host‑based allow‑lists for monitoring. Users of the Trezor brand should be warned that any setup URL not hosted on the official trezor.io domain is likely fraudulent. Continuous monitoring of related Weebly‑hosted subdomains is advised to detect future impersonation attempts.