gemini-coins[.]sbs

The domain gemini-coins.sbs was identified as a brand impersonation threat by PhishDestroy's automated analysis, specifically targeting the Gemini cryptocurrency exchange brand. This domain was created on May 21, 2026, and its page title was set to 'Gemini' to deceive visitors into believing they were accessing the legitimate Gemini platform. The threat type is classified as brand impersonation, with no specific drainer kit identified, but the domain likely hosted a fake login page designed to steal credentials.

Technical indicators for gemini-coins.sbs reveal a concerning risk profile. VirusTotal flagged the domain with 4 out of 95 security vendors marking it as malicious, indicating moderate detection across the security community. The domain was registered through NameSilo, LLC and resolves to IP address 101.99.80.135. Its SSL certificate was issued by Let's Encrypt / R13, providing a false sense of security to users. The domain appears on 3 security blocklists, and Google Safe Browsing status was not provided but the elevated risk level suggests potential blacklisting. These indicators collectively point to a sophisticated impersonation attempt, leveraging a legitimate-looking certificate and recent registration to evade initial detection.

Currently, gemini-coins.sbs has been taken offline, reflecting successful response actions to neutralize the threat. However, residual risk remains as similar domains may reappear under different TLDs or with slight variations. PhishDestroy recommends that users who may have interacted with this domain change their Gemini passwords immediately and enable two-factor authentication. Always verify URLs directly on the official Gemini website before entering credentials. For ongoing protection, users should rely on PhishDestroy's real-time monitoring and blocklist updates to stay ahead of emerging phishing campaigns.