gemini555[.]vip

This domain, gemini555.vip, is flagged for brand impersonation phishing activity targeting users through fraudulent online gambling services. Analysis indicates the domain mimics legitimate platforms under the guise of "GEMINI555 เว็บตรงสล็อตออนไลน์ อันดับ 1 ในเอเชีย," a tactic commonly associated with credential harvesting and financial fraud. No specific drainer kit signatures have been identified, but the impersonation of regional online services suggests intent to deceive users into disclosing sensitive information or transferring funds. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Porkbun LLC, an uncommon registrar for malicious activity but not unprecedented. It resolves to the IP address 172.67.204.133, hosted on Cloudflare’s network (AS13335), which is frequently leveraged to obfuscate origins and evade takedowns. Detection metrics show 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate legitimacy, a common characteristic of phishing infrastructure. The domain is currently offline, likely following enforcement actions or automated takedowns. However, residual risk persists due to the domain’s recent registration and the potential for reemergence under similar infrastructure. Users are advised to treat any prior interactions with gemini555.vip as compromised, particularly if credentials or financial details were submitted. Organizations should monitor for related domains registered through Porkbun LLC or resolving to Cloudflare IPs, as these may indicate follow-up campaigns. Proactive blocking of the IP 172.67.204.133 and associated domains is recommended to mitigate further exposure.