gemini-logoin[.]godaddysites[.]com

This domain, gemini-logoin.godaddysites.com, is identified as a brand impersonation phishing site targeting Gemini, a cryptocurrency exchange platform. The page title, "Gemini: Loℊin | Sign In," employs a homoglyph attack (replacing 'g' with 'ℊ') to deceive users into believing they are accessing the legitimate Gemini login portal. No specific drainer kit signatures were observed in available telemetry, but the use of homoglyphs and brand impersonation aligns with credential harvesting tactics commonly deployed in cryptocurrency phishing campaigns. Analysis indicates the domain was created on November 18, 2013, and is registered through GoDaddy.com, LLC. It resolves to the IP address 13.248.243.5, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Go Daddy Secure Certificate Authority - G2, a common provider for both legitimate and malicious domains. At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and was not detected by Google Safe Browsing at the time of analysis. The domain has been taken offline, likely due to enforcement actions by the hosting provider or domain registrar following reports of malicious activity. While the immediate threat has been mitigated, the infrastructure remains a potential vector for future abuse. Organizations and users are advised to monitor for re-registration or re-emergence of the domain under similar homoglyph variations. Network defenders should block the IP address 13.248.243.5 and implement detection rules for homoglyph-based phishing attempts targeting cryptocurrency platforms. Users should verify domain authenticity through official channels and enable multi-factor authentication to mitigate credential theft risks.