trezar-bridge[.]square[.]site

Analysis indicates that the domain trezar-bridge.square.site is actively impersonating Trezor, a hardware cryptocurrency wallet provider, as of July 12, 2026. The domain resolves to IP address 74.115.51.5 and was registered on February 5, 2019, through MarkMonitor, Inc. Despite its long registration history, the domain is currently flagged by multiple security mechanisms, including SEAL, MetaMask, and PhishDestroy, and appears on three security blocklists. The page title, 'Trezõr® Brïdge® | Secure Crypto Management,' uses diacritical substitutions likely intended to evade basic text-based detection while maintaining visual similarity to the legitimate brand. VirusTotal reports that 15 out of 95 security vendors detect this domain as malicious, providing further evidence of its association with phishing activity. The domain uses a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. Gridinsoft assigns the domain a trust score of 0/100, reinforcing its classification as high-risk infrastructure. Defenders should treat this domain as part of an active brand impersonation campaign targeting cryptocurrency users. The combination of domain registration details, detection by multiple security vendors, and blocklist presence supports immediate blocking at the network and endpoint levels. Further investigation into associated IP infrastructure (74.115.51.5) and registrar activity may reveal additional linked domains. No evidence currently suggests this is part of a broader phishing kit, but monitoring for similar naming patterns (e.g., diacritical obfuscation) is recommended for proactive detection.