m[.]geminiex[.]top

This domain, m.geminiex.top, is identified as a high-risk brand impersonation threat currently offline. The target of the impersonation is Blur, a decentralized finance and NFT marketplace platform. Analysis confirms the domain was designed to deceive users into believing they were interacting with an official Blur-related service, likely for fraudulent asset transfers or credential harvesting. Infrastructure analysis reveals the domain was registered on June 6, 2025, through Gname.com Pte. Ltd. and resolves to the IP address 8.213.158.29, hosted on autonomous system AS45102 (Alibaba (US) Technology Co., Ltd.) in South Korea. The domain lacks an SSL certificate, a common red flag in phishing operations. Security vendors have flagged this domain as malicious, with 10 of 95 VirusTotal engines detecting it. It appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The page title, GeminiEx, further suggests an attempt to mimic legitimate cryptocurrency exchange branding. As of the latest assessment, m.geminiex.top has been taken offline, though residual risk remains due to its recent activity and infrastructure. Organizations are advised to block the domain and its associated IP at the perimeter level. Users who may have interacted with the site should revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Security teams should treat this domain as part of a broader campaign targeting cryptocurrency users and prioritize monitoring for related infrastructure or impersonation attempts.