trezor-io-start-en[.]square[.]site

The domain trezor-io-start-en.square.site impersonates Trezor, a well-known cryptocurrency hardware wallet brand. Despite being taken down, it was previously flagged as malicious by 15 out of 91 vendors on VirusTotal. This domain was listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, indicating its recognition as a threat by multiple cybersecurity entities.

The domain was registered through MarkMonitor Inc. and hosted on IP address 74.115.51.4. It used an SSL certificate issued by Let's Encrypt, a common provider for both legitimate and malicious sites. The page title, "Trezor.io/Start – Your Complete Setup Guide," suggests the site was designed to deceive users into believing they were accessing Trezor's official setup guide, thereby potentially capturing sensitive information like recovery seeds or passwords.

PhishDestroy detected the domain on the same day it was created, June 15, 2026, highlighting the speed at which phishing operations can be deployed. The platform risk score of 90 out of 100 underscores the site's high threat level. The swift takedown of the site mitigates immediate risk, but the incident serves as a reminder of the persistent threat of phishing attacks targeting cryptocurrency users.