gemstonetradehub[.]cc

The domain gemstonetradehub.cc was registered through Dynadot LLC and first observed on 21 February 2026. DNS resolution points to the IPv4 address 198.27.109.53, which is hosted in Canada under AS16276 owned by OVH SAS. The authoritative name servers ns5.ddoscure.com and ns6.ddoscure.com resolve to the same host, indicating a single‑point hosting environment. The site served an HTTPS certificate issued by Let’s Encrypt (R12), confirming that TLS was active at the time of analysis. A page title retrieved from the site reads “Gemstonetradehub Limited – Innovative solutions”, but no further content analysis is available because the host is currently taken offline.

Technical fingerprinting shows a typical LAMP stack: WordPress, MySQL, PHP, combined with front‑end libraries UIKit, jQuery, and Nginx as the web server. The presence of JivoChat suggests an attempt to provide live‑chat interaction, a common tactic in credential‑harvesting campaigns. VirusTotal scans reported that five of ninety‑three antivirus engines flagged the domain as malicious, and Gridinsoft assigned a trust score of zero out of one hundred, indicating a high confidence of abuse. The domain appears on a single public blocklist and is explicitly listed by PhishDestroy as a phishing resource.

Given the combination of a recent creation date, dedicated hosting, active TLS, a WordPress‑based site, and multiple security vendor detections, the evidence supports a classification of generic phishing. The exact phishing payload or target brand has not been disclosed, and no additional artifacts such as malicious URLs or credential‑stealing forms have been captured. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP and name servers, and update internal threat intel feeds with the provided indicators.