geminiapi[.]yyyhk[.]org

The domain geminiapi.yyyhk.org is engaged in a brand impersonation campaign targeting the cryptocurrency exchange Gemini. This active threat, assessed at an elevated risk level, presents a login page designed to harvest user credentials. The domain was created on March 27, 2026, and registered through Cloudflare, Inc., which often provides anonymity for malicious sites. It resolves to IP address 104.21.52.92 and is secured with an SSL certificate from Google Trust Services, lending a false sense of legitimacy.

Technical indicators reveal that geminiapi.yyyhk.org appears on three security blocklists and has been flagged by 1 out of 95 VirusTotal vendors. Despite the low detection rate, the combination of brand impersonation and a fake login page strongly suggests malicious intent. The domain's registration through Cloudflare and its recent creation date further raise suspicion. PhishDestroy's analysis confirms that the site mimics the Gemini brand to deceive users into entering sensitive information.

Given the active status and elevated risk, users should avoid any interaction with geminiapi.yyyhk.org. PhishDestroy recommends that organizations block this domain and educate users about verifying official URLs before entering credentials. Reporting the domain to security vendors and hosting providers can help reduce its lifespan. Vigilance against phishing attempts remains key to protecting digital assets.