gemini[.]951520[.]xyz

This domain, gemini.951520.xyz, is flagged as a brand impersonation threat targeting Gemini, a cryptocurrency exchange platform. The domain is currently offline but was actively used to host a verification-themed page titled '验证页面 - Gemini Balance,' designed to deceive users into disclosing sensitive credentials or transferring assets. Analysis indicates the domain was operational until recently, with infrastructure configured to mimic legitimate Gemini services, posing a significant risk to unsuspecting users. Infrastructure analysis reveals the domain was registered through Spaceship, Inc. on April 16, 2025, and resolved to the IP address 43.174.247.32, hosted under AS139341 (ACE) in Singapore. The domain was flagged by 23 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. Additionally, it appears on one security blocklist and was proactively blocked by enterprise-grade threat intelligence systems. The SSL certificate, issued by TrustAsia DV TLS RSA CA 2025, provides minimal assurance, as Domain Validation (DV) certificates are commonly exploited in phishing campaigns due to their low verification threshold. As of the latest assessment, gemini.951520.xyz has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the underlying threat remains active, as similar domains may emerge using comparable infrastructure or tactics. Organizations and users are advised to monitor for newly registered domains impersonating Gemini, particularly those with recent creation dates or resolving to the same IP range. Network-level blocking of the IP 43.174.247.32 and its associated ASN (AS139341) is recommended to mitigate residual risk. Users should verify domain authenticity through official channels and report suspicious activity to relevant security teams for further investigation.