# PhishDestroy domain threat record: geminixtrade-ai.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/geminixtrade-ai.com/ Machine-readable companion: https://phishdestroy.io/domain/geminixtrade-ai.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 19:47:08 UTC - Last availability or vendor check: 2026-10-27 23:00:25 UTC - Stored record updated: 2026-10-27 23:40:15 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Gemini ## Stored infrastructure - Observed IP address: 188.114.97.1 - Registrar in stored WHOIS data: MAT BAO CORPORATION - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-04-13 23:18:13 UTC ## Evidence links - URLScan report: https://urlscan.io/result/019f88dc-5803-72dc-b1f3-0e01ac954de7/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/geminixtrade-ai.com - Certificate Transparency search: https://crt.sh/?q=%25.geminixtrade-ai.com - Web Archive lookup: https://web.archive.org/web/*/https://geminixtrade-ai.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added geminixtrade-ai.com to its internal blocklist on 2026-10-27. The recorded page title claims to be an AI trading platform referencing the Gemini brand, but no affiliation is established. An HTTP 200 response was observed on the same date. The intake cited a trusted report due to the domain’s 196‑day age at first sighting. How the scam works The listing and detections do not establish a specific mechanism. Brand references on a page can be used to deceive visitors, but the actual behavior of the site is not confirmed by PhishDestroy’s checks. Evidence VirusTotal detected 17 flags across 92 engines on 2026-10-19, with 14 malicious and 3 suspicious. Google Safe Browsing did not flag the domain on 2026-10-27. URLScan’s engine score was 97 (malicious) on 2026-07-22, while the overall verdict was non‑malicious. OTX listed three pulses mentioning the domain on 2026-10-27. PhishDestroy’s internal blocklist flags the domain; external blocklists returned zero hits on 2026-10-27. Infrastructure Registered with MAT BAO CORPORATION on 2026-04-14, the domain uses Cloudflare with nameservers bob.ns.cloudflare.com and tina.ns.cloudflare.com. TLS is issued by Google Trust Services, valid until 2027-01-06, and DNSSEC is not enabled. What to do Avoid entering credentials or personal information on the site. If already submitted, change passwords and monitor accounts for unusual activity. Security teams can block this exact domain and review access logs for connections. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/019f88dc-5803-72dc-b1f3-0e01ac954de7/ Cloudflare Radar report: https://radar.cloudflare.com/scan/be1364cc-1165-4b17-838a-a50ce3235adf Stored capture screenshot: https://urlscan.io/screenshots/019f88dc-5803-72dc-b1f3-0e01ac954de7.png Cloudflare Radar screenshot (2026-10-27T19:57:47Z): https://screenshots.phishdestroy.io/cf/be1364cc-1165-4b17-838a-a50ce3235adf.png URLScan screenshot (2026-07-21T11:15:29Z): https://screenshots.phishdestroy.io/us/019f8463-3b93-722d-9dc5-3d7f243a6eec.png URLScan capture report: https://urlscan.io/result/019f8463-3b93-722d-9dc5-3d7f243a6eec/ VirusTotal report: https://www.virustotal.com/gui/domain/geminixtrade-ai.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=geminixtrade-ai.com Archived copy: https://web.archive.org/web/20261027195231/https://geminixtrade-ai.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 20:30:06 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/019f88dc-5803-72dc-b1f3-0e01ac954de7.png Captured: 2026-10-27 19:47:08 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/019f88dc-5803-72dc-b1f3-0e01ac954de7.png Source report: https://urlscan.io/result/019f88dc-5803-72dc-b1f3-0e01ac954de7/ - URLScan · 2026-07-21: https://screenshots.phishdestroy.io/us/019f8463-3b93-722d-9dc5-3d7f243a6eec.png Captured: 2026-07-21 11:15:29 UTC Source report: https://urlscan.io/result/019f8463-3b93-722d-9dc5-3d7f243a6eec/ SHA-256: 279a70db1c29edb21eda0dc437bc2e28b4584c2e27de2d6e5f9c8fe5a2b99d9a - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/be1364cc-1165-4b17-838a-a50ce3235adf.png Captured: 2026-10-27 19:57:47 UTC Source report: https://radar.cloudflare.com/scan/be1364cc-1165-4b17-838a-a50ce3235adf SHA-256: 2b9c3d9dc5063157c7b240ddced4f75fcc8985585caec8463a9c9fb6e8f9c774 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T20:00:51Z", "uuid": "019f88dc-5803-72dc-b1f3-0e01ac954de7", "scanned_at": "2026-07-22T08:06:16Z", "final_url": "https://geminixtrade-ai.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://geminixtrade-ai.com/", "from": "http://geminixtrade-ai.com/", "status": 307 } ], "ip": "104.21.78.223", "domains": [ "fonts.googleapis.com", "cdnjs.cloudflare.com", "fonts.gstatic.com", "cdn.jsdelivr.net", "static.cloudflareinsights.com", "static.cloudflare.com" ], "ips": [ "192.178.155.94", "104.17.207.5", "192.178.218.95", "104.17.24.14", "104.21.78.223" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "235e498b05ab2b9a13259d1f1af7ee2afe24043edcc466a59b4bdf89eebc570b", "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "LANG_MSGS", "ClientJS", "_pz9420", "toggleTermsPopup", "__cfQR", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "tls": { "san": [ "geminixtrade-ai.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "geminixtrade-ai.com", "protocol": "TLS 1.3", "valid_to": "2026-09-10T13:55:49Z", "valid_from": "2026-06-12T12:56:01Z" }, "domain_age_days": 99, "apex_age_days": 99, "tls_age_days": 39, "tls_valid_days": 90, "requests": 20, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "frame-ancestors 'self'; img-src 'self' data: blob:; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T20:00:54Z", "uuid": "be1364cc-1165-4b17-838a-a50ce3235adf", "scanned_at": "2026-10-27T19:57:47Z", "final_url": "https://geminixtrade-ai.com/", "status": 200, "history": [ { "url": "https://geminixtrade-ai.com/", "status": 200 } ], "dom_hash": "a9ad79cd443097c35b2a9b200efe320a78d15077cc46e3f106383a5747023724", "doc_hash": "4a870c51fe40cb06ee4a4d67fdc49e82f7e882564bc5e56f3263e82fb372acf0", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "geminixtrade-ai.com", "type": "A", "value": "172.67.137.221" }, { "name": "geminixtrade-ai.com", "type": "A", "value": "104.21.78.223" }, { "name": "geminixtrade-ai.com", "type": "AAAA", "value": "2606:4700:3032::ac43:89dd" }, { "name": "geminixtrade-ai.com", "type": "AAAA", "value": "2606:4700:3037::6815:4edf" } ], "dnssec_valid": false, "ip": "127.0.1.20", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "MAT BAO CORPORATION", "created": "2026-04-14T01:18:13Z", "updated": "2026-06-13T02:15:30Z", "expires": "2027-04-14T01:18:13Z", "nameservers": [ "bob.ns.cloudflare.com", "tina.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-27T20:27:00Z", "analysis_at": "2026-10-19T13:46:52Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 14, "suspicious": 3, "undetected": 30 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "MAT BAO CORPORATION", "created": "2026-04-14T01:18:13Z", "expires": "2027-04-14T01:18:13Z", "updated": "2026-06-13T02:15:30Z", "first_seen": "2026-04-14T07:03:53Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.78.223" }, { "ttl": 21600, "type": "NS", "value": "bob.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:89dd" }, { "ttl": 300, "type": "A", "value": "172.67.137.221" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:4edf" }, { "ttl": 21600, "type": "NS", "value": "tina.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "bob.ns.cloudflare.com" } ], "dns_at": "2026-10-19T13:52:25Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "geminixtrade-ai.com" ], "issuer": "Google Trust Services / WE1", "serial": "783e43ebce04635f0e90dc4c6ee72b1e", "sha256": "e37816de61a5da2c0669087465dcce623a5e082f87eec7d8ccbc3558e6834434", "subject": "geminixtrade-ai.com", "valid_to": "2027-01-06T22:55:26Z", "valid_from": "2026-10-08T21:55:30Z" }, "whois": { "registrar": "MAT BAO CORPORATION", "registrar_iana_id": "1586", "registrar_url": "http://www.matbao.net", "created": "2026-04-14T01:18:13Z", "updated": "2026-06-13T02:15:30Z", "expires": "2027-04-14T01:18:13Z", "status": [ "ok" ], "nameservers": [ "bob.ns.cloudflare.com", "tina.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "active" ], "events": { "last changed": "2026-06-13T02:15:30Z", "registration": "2026-04-14T01:18:13Z", "registrar expiration": "2027-04-14T01:18:13Z", "last update of RDAP database": "2026-10-17T15:35:31Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T20:01:14Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "geminixtrade-ai.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-27T19:52:31Z", "first": "2026-10-15T01:32:40Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.08, "avg_page_bytes": 41875 }, "robots_txt": { "agents": [ "*", "Amazonbot", "Applebot-Extended", "Bytespider", "CCBot" ], "present": true, "sitemaps": [ "https://geminixtrade-ai.com/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 140 }, "social_tags": { "title": "Gemini Xtrade AI | AI Trading Platform | Official Website", "description": "Gemini Xtrade AI delivers a premium, AI-driven trading platform featuring autonomous bots, intelligent guidance, robust safeguards, and real-time analytics.", "canonicalUrl": "https://geminixtrade-ai.com/" }, "trackers": { "requests": 20, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 6 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://static.cloudflare.com/beacon.min.js", "https://challenges.cloudflare.com/turnstile/v0/api.js", "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 4, "tls": 33, "wait": 181, "connect": 7, "download": 47 }, "response_ms": 272 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 145134, "co2_grams": 0.0053, "cleaner_than": 14 }, "dns_server": { "ns": [ { "ip": "108.162.193.104", "host": "bob.ns.cloudflare.com" }, { "ip": "172.64.32.230", "host": "tina.ns.cloudflare.com" } ], "zone": "geminixtrade-ai.com" }, "cookies": { "cookies": [ { "name": "entry_url", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "geminixtrade-ai.com" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "bob.ns.cloudflare.com", "tina.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"bob.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418084881, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "frame-ancestors 'self'; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; style-src '", "strictTransportPolicy": "max-age=31536000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://geminixtrade-ai.com" ] }, "tech_stack": { "technologies": [ "jsDelivr", "Cloudflare Turnstile", "Cloudflare Rocket Loader", "ClientJS", "Priority Hints", "Google Font API", "HSTS", "Cloudflare", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 12 }, "whois": { "registrar": "MAT BAO CORPORATION", "created": "2026-04-14T01:18:13Z", "updated": "2026-06-13T02:15:30Z", "expires": "2027-04-14T01:18:13Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "bob.ns.cloudflare.com", "tina.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "frame-ancestors 'self'; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com;", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } } } } ```