gemincxologin[.]gitbook[.]io

This domain, gemincxologin.gitbook.io, is actively impersonating the Gemini brand for a crypto scam operation. Analysis confirms it is flagged as a social engineering threat by Google Safe Browsing and appears on two security blocklists: PhishDestroy and PhishingDB. VirusTotal reports that 20 out of 95 security vendors flag this domain as malicious. The domain was created on March 30, 2014, and is registered through Cloudflare, Inc., resolving to IP address 172.64.147.209, which is hosted by Cloudflare (AS13335) in the United States. The page title observed is 'Ɠemini Login', which uses a Unicode character (Ɠ) to visually mimic the legitimate Gemini login page. The domain returns an HTTP 307 redirect status, indicating it likely redirects visitors to another malicious endpoint. SSL certificate is issued by Google Trust Services, and technologies detected include GitBook, Google Cloud, HSTS, Google Cloud Trace, Cloudflare, and HTTP/3. Nameservers are dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The Gridinsoft trust score is 0 out of 100, confirming high risk. Defenders should block this domain at the network level, add it to URL threat intelligence feeds, and monitor for related subdomains or IPs that may be part of the same phishing infrastructure. The exact content of the landing page has not been analyzed, but the combination of the brand impersonation, Unicode trick in the title, and low trust score strongly indicates a credential harvesting or crypto wallet theft campaign. Organizations should alert users who may have visited this domain to change passwords and enable multi-factor authentication on affected accounts.