gemini[.]91vip[.]de

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Gemini, a regulated cryptocurrency exchange platform. Analysis indicates the site employs deceptive tactics, including a localized page title in Chinese (验证页面 - Gemini Balance), to trick users into divulging account credentials or authorizing malicious transactions. The threat type aligns with credential theft and potential crypto drainer activity, where attackers gain unauthorized access to digital wallets or exchange accounts to siphon funds. Infrastructure analysis reveals the domain gemini.91vip.de resolves to the IP address 45.8.112.44, hosted by an entity in Japan with ties to Greencloud LLC. At the time of assessment, 19 out of 95 security vendors on VirusTotal had flagged the domain as malicious, while it appeared on at least one security blocklist. The registrar details remain undisclosed, but the domain's creation date is not publicly available in the provided intelligence. Detection metrics indicate a moderate but concerning level of consensus among security tools, with a single blocklist entry suggesting early-stage mitigation efforts. The domain has since been taken offline, though its prior operational status and targeting of a high-value brand warrant continued vigilance. Mitigation steps for organizations and end-users include immediate blacklisting of the domain and its associated IP address (45.8.112.44) across all security controls. Users who may have interacted with the site should revoke any active sessions or API keys linked to Gemini accounts and enable multi-factor authentication (MFA) using hardware-based tokens or app-generated codes. Financial institutions and crypto platforms should monitor for anomalous login attempts or transaction patterns originating from the identified infrastructure. Security teams are advised to conduct retrospective analysis of logs for connections to 45.8.112.44 or related subdomains, as well as to deploy indicators of compromise (IOCs) for proactive threat hunting.