629371gemini.com is a phishing domain that poses as Gemini, the cryptocurrency exchange, to lure its customers into handing over account access. The random numeric prefix bolted onto the brand name is typical of throwaway lookalikes that are spun up in batches and passed around in ads, messages and fake support chats. PhishDestroy first flagged it on 2026-08-08. When last checked on 2026-10-19, the domain still resolved but its page content did not load, so it could return at any time.
How the scam works
Gemini impersonation pages copy the exchange's branding and sign-in flow so that a visitor believes they are logging into their real account. Anything typed in, including email, password, two-factor codes or identity documents, goes straight to the operators. They can then log in to the genuine account and withdraw the balance. Variants of this scheme also push a fake 'wallet verification' step that asks for a recovery phrase or a wallet connection, which exposes self-custody funds as well.
Evidence
On 2026-09-13, 11 of 89 VirusTotal engines classed the domain as malicious, including Kaspersky, BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, CRDF and alphaMountain.ai. That is a modest share, but these vendors operate independently and reached the same verdict. Spamhaus lists the domain in its DBL under the phishing category. MetaMask and the SEAL security alliance both block it, so wallet users get a warning before the page loads. The domain also appears in three AlienVault OTX threat pulses.
Infrastructure
The domain was registered on 2026-08-07 through Cloudflare's registrar and was detected one day later. That timeline points to a site built specifically for this campaign rather than a hijacked older domain. Traffic is served through Cloudflare's network, with the visible address geolocating to Canada. Because Cloudflare acts as a proxy, that address belongs to the proxy and does not show where the actual server sits.
What to do
If you entered your Gemini credentials here, change your password at once from the official app and reset two-factor authentication. Then review recent logins, withdrawals and whitelisted addresses, and contact Gemini support. If you typed in a recovery phrase, treat that wallet as compromised and move its funds to a new wallet. If you connected a wallet, revoke any approvals granted during that session. Security teams should block the domain at DNS and the proxy, and search their mail and chat logs for lookalike Gemini domains that use numeric prefixes.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
