gb2[.]err429[.]com

This domain is flagged for brand impersonation, specifically targeting Gemini cryptocurrency platform users through a fraudulent verification page. The threat type involves credential harvesting, where victims are lured into submitting sensitive login or authentication details under the pretense of account validation. The page title, "验证页面 - Gemini Balance," directly mimics Gemini’s branding, increasing the likelihood of successful deception. Analysis indicates the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to the IP address 103.69.129.37, hosted in Hong Kong under AS63473 (HostHatch, LLC). VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is currently blocked by a dedicated anti-phishing system. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for both legitimate and malicious domains. The domain’s status is currently offline, though this does not eliminate residual risk from cached or redistributed phishing materials. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (103.69.129.37) at the network perimeter. Organizations should deploy email and web filtering rules to prevent delivery or access to URLs containing "err429.com" or similar subdomains. End-users should be alerted to the presence of fake verification pages, particularly those using non-Latin characters in the title. Gemini account holders should enable multi-factor authentication and monitor for unauthorized access attempts. If credentials were entered on this domain, password resets and account reviews are critical.