gemlogine[.]godaddysites[.]com

This domain is assessed at an elevated risk level due to its confirmed role as a cryptocurrency credential harvesting site. Analysis indicates the infrastructure was specifically designed to impersonate the Gemini cryptocurrency exchange, targeting users attempting to log in to their accounts. The page title 'Gemini login' and domain structure mimic legitimate authentication portals, increasing the likelihood of successful deception against unsuspecting victims. Infrastructure analysis reveals the domain gemlogine.godaddysites.com was registered through GoDaddy.com, LLC on November 18, 2013, though repurposed for malicious activity. It resolves to IP address 13.248.243.5, hosted within Amazon.com, Inc. (AS16509) infrastructure in the United States. Security vendor detections on VirusTotal reached 18 out of 95, indicating moderate but consistent identification as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and was subsequently taken offline. The SSL certificate is issued by Go Daddy Secure Certificate Authority - G2, providing a false sense of legitimacy to potential victims. Mitigation against cryptocurrency credential harvesting requires immediate action from both users and platform operators. Affected users should revoke any active sessions, reset credentials through official channels, and enable multi-factor authentication where available. Cryptocurrency exchanges should implement domain monitoring to detect impersonation attempts and issue takedown requests for fraudulent infrastructure. Network defenders should block the domain and associated IP address (13.248.243.5) at perimeter controls. Security teams are advised to search logs for connections to gemlogine.godaddysites.com and the resolving IP to identify potential compromised accounts within their environments.