gemmacoin[.]io

The domain gemmacoin.io was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows the domain resolves to the IPv6 address 2600:1901:0:84ef::, which belongs to Google LLC under ASN 396982 in the United States. The site presented an SSL certificate labeled “E5,” indicating a low‑grade issuance. Static content observed from the page title – “Gemma - Decentralized Crypto For Micropayments | Gemma” – suggests the site was positioned as a cryptocurrency service, yet the scam type is explicitly identified as Brand Impersonation targeting the brand blur.

Reputation services assign the domain extremely low trust scores: Scamadviser 1 / 100 and Gridinsoft 23 / 100, reflecting high confidence in malicious intent. VirusTotal reports a single detection out of 93 scanning engines, and the domain appears on one security blocklist. PhishDestroy has already blocked the domain, confirming its malicious classification.

While the page content has not been publicly reviewed, the convergence of a newly created domain, poor TLS grading, low trust scores, a brand‑targeted impersonation label, and detection by multiple security products provides concrete evidence of a credential‑harvesting or brand‑spoofing operation. Defenders should immediately add gemmacoin.io to DNS and proxy blocklists, enforce strict outbound filtering for the associated IP range, and incorporate the observed indicators (SSL grade, IPv6 address, trust scores, and detection flag) into intrusion detection signatures. Continuous monitoring for newly registered domains using the same brand name or similar SSL characteristics is advised to pre‑empt replication of this impersonation campaign.