gemnxixlogen[.]gitbook[.]io

This domain, gemnxixlogen.gitbook.io, is flagged as a high-risk generic phishing site targeting users of the Gemini cryptocurrency exchange platform. Analysis of the page title, 'Ɠemini @ Login,' confirms the domain is designed to mimic the legitimate Gemini login interface, likely to harvest user credentials and sensitive financial information. No specific drainer kit signatures have been identified, but the use of Unicode characters in the page title suggests an attempt to evade basic detection mechanisms. Infrastructure analysis reveals the following technical indicators: the domain was created on June 12, 2026, and is registered through Cloudflare, Inc. It currently resolves to the IP address 104.18.40.47, a Cloudflare proxy endpoint. VirusTotal reports 14 out of 95 security vendors flagging this domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which is consistent with legitimate services but does not mitigate the phishing risk. Google Safe Browsing (GSB) has not yet listed this domain, indicating a potential gap in automated detection coverage. As of the latest assessment, gemnxixlogen.gitbook.io remains active and continues to host the fraudulent login portal. The domain has been blocked by PhishDestroy, but users may still encounter it through phishing emails, social engineering, or malvertising campaigns. The remaining risk is classified as high due to the domain's operational status, low detection rate on blocklists, and the critical nature of the targeted platform (cryptocurrency exchange). Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication (MFA) on all financial accounts, and report the domain to their security teams for further mitigation. Organizations should consider adding this domain to internal blocklists and monitoring for related indicators of compromise (IOCs).