gemini-balance[.]haleima[.]cn

This domain, gemini-balance.haleima.cn, presents a fraudulent verification page targeting users of the Gemini cryptocurrency exchange. The page, titled "验证页面 - Gemini Balance," mimics legitimate account verification processes to harvest credentials or sensitive financial data. Analysis indicates the domain is designed to exploit trust in the Gemini brand, potentially leading to unauthorized access to user accounts or direct cryptocurrency theft through fake login portals or crypto drainer scripts embedded in the page. Infrastructure analysis reveals the domain was registered on February 24, 2026, through 腾讯云计算（北京）有限责任公司, a registrar commonly associated with malicious activity. It resolves to IP address 172.67.134.192, hosted on Cloudflare infrastructure (AS13335). The domain is flagged by 23 out of 95 security vendors on VirusTotal, and appears on one security blocklist, indicating a moderate to elevated risk level. The SSL certificate, issued by Google Trust Services (WE1), further suggests an attempt to appear legitimate while conducting fraudulent operations. Users who have visited gemini-balance.haleima.cn or entered credentials on the site should immediately revoke any active sessions on their Gemini account and enable multi-factor authentication if not already active. All passwords associated with the account should be changed, and any linked financial instruments or cryptocurrency wallets should be reviewed for unauthorized transactions. Monitoring for phishing attempts via email or SMS is recommended, as attackers may follow up with additional fraudulent communications. If cryptocurrency was transferred or wallet details were provided, affected users should report the incident to their local cybercrime authorities and the targeted exchange for potential mitigation steps.