oi365-gemini[.]com

This domain is flagged for elevated-risk brand impersonation targeting Gemini, a cryptocurrency exchange platform. The threat involves a fraudulent login portal designed to mimic Gemini’s authentication flow, specifically leveraging Google Sign-in integration to harvest user credentials. Analysis indicates the domain is engineered to deceive users into entering sensitive account details under the guise of legitimate authentication, increasing the likelihood of unauthorized account access and financial theft. Infrastructure analysis reveals multiple high-risk indicators. The domain oi365-gemini.com was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent domains. It resolves to the IP address 188.114.96.3 and is currently offline, though it previously hosted a page titled 'Oi365-Gemini.' Security vendors on VirusTotal flagged the domain at a 3/95 detection rate, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist, specifically PhishDestroy, and employs technologies such as Vue.js, Cloudflare, and HSTS, alongside an SSL certificate issued by Google Trust Services. These technical elements suggest an attempt to appear legitimate while concealing malicious intent. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address (188.114.96.3) across all network security layers. Organizations should update endpoint protection rules to flag domains registered through high-risk registrars like Gname.com Pte. Ltd. and monitor for similar naming patterns (e.g., 'oi365-' prefixes). Users should be educated to verify domain authenticity before entering credentials, particularly on pages requesting Google Sign-in. Security teams are advised to review logs for connections to 188.114.96.3 and investigate any prior interactions with the domain, as it may indicate compromised accounts or attempted fraud.