gemini[.]zhengniao[.]com

Analysis of gemini.zhengniao.com, observed as a brand‑impersonation site targeting the Gemini cryptocurrency platform, indicates that the domain was registered on 21 February 2026 through the registrar 22net, Inc. The authoritative name servers ns1.22.cn and ns2.22.cn resolve the domain to the IPv4 address 43.134.173.174, which belongs to ASN 132203 and is hosted in Singapore within a Tencent‑owned facility on Kejizhongyi Avenue. No TLS certificate was presented during connection attempts, and the site currently returns an offline HTTP status, consistent with the reported “taken offline” state. The page title returned by the server, “Gemini国内站”, directly references the targeted brand and suggests a domestic‑focused landing page. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion.

Independent scanning on VirusTotal recorded three positive detections out of ninety‑three scanners, and the domain appears on three public blocklists. Google Safe Browsing classifies the site under the “social engineering” category, and the domain is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. Evidence points to a crypto‑scam motive, yet the exact payload or credential‑harvesting mechanism has not been publicly disclosed.

The lack of an SSL certificate and the offline status limit immediate technical observation of the malicious page content. Defenders should continue to block the domain at network perimeter devices, update DNS‑based blacklists with the identified IP address and name server information, and monitor for any resurgence of the host under alternative subdomains. Given the brand‑impersonation nature, users of the Gemini platform should be warned of potential phishing attempts that reference the “Gemini国内站” title, and any unsolicited communications directing users to the domain should be treated as malicious.