market-getgems[.]store

Analysis of market-getgems.store shows a brand‑impersonation infrastructure targeting Binance. The domain was registered on July 25, 2025 through NameCheap, Inc. and resolves to IP address 184.94.213.28, an AS22612 Namecheap hosting node located in the United States. The site presented the page title “Getgems — TON NFT Marketplace” and used a Sectigo Public Server Authentication CA DV R36 SSL certificate, indicating a valid TLS certificate despite the malicious intent.

Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal scans reported a single detection out of 93 security vendors, confirming that at least one engine flagged the domain as malicious. The domain appears on one public security blocklist and is actively blocked by PhishDestroy.

Current operational status is offline, suggesting the operators have taken the site down or it was seized. Defenders should add 184.94.213.28 to network deny lists, enforce DNS blocking for market-getgems.store, and monitor for any re‑registration attempts using the same registrar or hosting provider. Continuous threat‑intel feeds should be consulted for any resurgence of the Binance impersonation pattern, and endpoint detection rules should be updated to flag any URLs containing the “Getgems” keyword or the observed TLS certificate fingerprint.