gemini-eth[.]top

The domain gemini-eth.top is identified as a high-risk brand impersonation threat specifically targeting Gemini, a cryptocurrency exchange platform. This domain is designed to deceive users into believing they are interacting with legitimate Gemini services, potentially leading to unauthorized access to accounts, theft of credentials, or loss of digital assets. Analysis confirms the domain is currently offline, though its prior activity remains a significant concern for security teams and end-users. Infrastructure analysis reveals gemini-eth.top was flagged by 12 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The domain resolves to the IP address 101.99.80.135 and was registered on May 24, 2024, through NameSilo, LLC. It appears on three security blocklists and holds a Gridinsoft trust score of 0/100, further confirming its malicious classification. The domain was actively blocked by multiple security providers, including MetaMask, PhishDestroy, and SEAL, which are known for mitigating cryptocurrency-related threats. As of the latest assessment, gemini-eth.top has been taken offline, reducing immediate risk to users. However, the domain's infrastructure and registration details suggest it may re-emerge under a different guise or be repurposed for future attacks. Organizations and individuals are advised to block the domain and its associated IP address (101.99.80.135) at the network level. Users should verify the authenticity of any Gemini-related communications by cross-referencing official domains and enabling multi-factor authentication on all cryptocurrency accounts. Security teams are recommended to monitor for similar impersonation domains using the same registrar or IP range.