gemini[.]lotxy[.]xyz

The domain gemini.lotxy.xyz was registered on July 25 2023 through PublicDomainRegistry.com (operated by PDR Ltd.). It resolves to IP 43.167.225.144, which is assigned to AS132203 in Japan, specifically a Tencent building location. The domain is served by Cloudflare DNS (casey.ns.cloudflare.com, daniella.ns.cloudflare.com) and does not present an SSL certificate, meaning connections are made over HTTP only. The observed page title is "验证页面 - Gemini Balance," indicating a verification page in Chinese that references the Gemini brand.

Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows 14 of 95 scanning engines flag the domain as malicious, reinforcing the classification as a brand‑impersonation campaign. The site is currently offline, limiting immediate exposure, but the underlying IP tied to a Tencent data center suggests the infrastructure could be reused for future malicious activity. Defenders should add the domain and its resolving IP to network deny‑lists, monitor for any re‑hosting of identical content, and watch for new sub‑domains under lotxy.xyz that may follow similar patterns.

Continuous scanning of the AS132203 address space is advised, along with periodic re‑query of VirusTotal and other threat‑intel feeds for changes in detection status. The lack of TLS simplifies detection via traffic inspection, and the Chinese‑language page title hints at a targeting vector for non‑English speakers. Until the domain is definitively retired, any traffic to the host should be treated as suspicious and subject to strict outbound filtering.