geminiloginan[.]gitbook[.]io

The domain geminiloginan.gitbook.io is identified as a brand impersonation threat targeting the Gemini cryptocurrency exchange. The domain is currently offline, which may indicate that it has been taken down by security teams or the registrar.

Analysis of the domain reveals that it was registered through Cloudflare, Inc. and resolves to the IP address 104.18.40.47. The domain was created on February 26, 2026. It has been flagged by 6 out of 95 security vendors on VirusTotal, suggesting a moderate level of suspicion. The SSL certificate is issued by Google Trust Services / WE1, which can lend a false sense of legitimacy to users. Additionally, the domain appears on 3 security blocklists, further indicating its malicious nature. The page title, 'Gemini Login | Cryptocurrency Exchange to Buy Bitcoin and Ether,' closely mimics the legitimate Gemini website, which can trick users into divulging sensitive information.

Given the current status of the domain being offline, it is recommended that users exercise caution and avoid visiting the site. Security teams should monitor the domain for any signs of reactivation and consider adding it to their blocklists. Organizations should also educate their users about the risks of brand impersonation and how to verify the authenticity of websites, particularly those related to financial transactions.