trejr-suite[.]square[.]site

The domain trejr-suite.square.site is presently active and classified as a high‑risk brand‑impersonation campaign targeting the Trezor brand. The site presents a page title of "Trezor Suite (Official) | Trezor Suite App - Trezor" and serves HTTP 200 responses over TLS using a Let’s Encrypt certificate (E8). DNS resolution points to IP 74.115.51.5, which belongs to AS27647 (Weebly, Inc.) and is located in the United States. The domain was registered on February 5, 2019 through MarkMonitor, Inc., and is hosted on infrastructure that includes Weebly, MySQL, PHP, Vue.js, reCAPTCHA, HSTS, and Cloudflare components. Nameservers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-810.awsdns. The site is listed on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows 12 of 91 security vendors flag the domain, while Gridinsoft assigns a trust score of 0/100. Current evidence confirms the domain’s role in a brand‑impersonation operation; however, the specific page content beyond the title has not been examined. Defenders should add the domain and its resolving IP to deny‑list controls, monitor for related lookup activity, and ensure that any credential‑capture vectors referencing Trezor are blocked. Continuous re‑evaluation is advised as the infrastructure may evolve.