gemini-trade-assistant[.]prowintech[.]in

This domain, gemini-trade-assistant.prowintech.in, is identified as a brand impersonation threat targeting Gemini, a regulated cryptocurrency exchange platform. The site masquerades as a legitimate trading assistant tool under the Gemini brand, likely designed to harvest user credentials, private keys, or facilitate unauthorized fund transfers. Current status indicates the domain has been taken offline, though prior activity remains a documented risk. Analysis reveals the domain was registered on November 11, 2025, through GoDaddy.com, LLC, and resolves to the IPv6 address 2a00:1450:4001:804::2013, hosted on Google Cloud infrastructure. The page title, 'Gemini Trading Assistant,' directly references the targeted brand, while detected technologies include Node.js, Express, Tailwind CSS, and Google Cloud Trace. Security assessments show a Gridinsoft trust score of 0/100, with one security vendor flagging the domain on VirusTotal (1/95). The domain appears on a single blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Infrastructure analysis indicates the threat actor leveraged cloud-based hosting and modern web frameworks to create a convincing facade. The use of Google Cloud and a valid SSL certificate suggests an attempt to evade basic detection mechanisms. Given the domain's offline status, immediate risk of active exploitation is reduced; however, users who interacted with the site prior to takedown should assume credential compromise. Recommended actions include revoking any exposed credentials, monitoring for unauthorized transactions, and verifying the legitimacy of any communications referencing Gemini or trading assistant tools. Organizations should update blocklists to include this domain and its associated IP address, while users are advised to enable multi-factor authentication on all cryptocurrency-related accounts.