gemor[.]cfd

gemor.cfd has been classified by PhishDestroy as an active credential harvesting phishing domain. The site poses an elevated risk to users due to its deployment in fraudulent login campaigns designed to steal credentials for high-value accounts such as banking, email, and social media platforms. Technical analysis indicates that the domain resolves to a known hosting infrastructure associated with malicious login portals, actively mimicking legitimate services to deceive visitors. The threat is ongoing and involves active propagation via phishing emails and messaging platforms.

This domain was flagged by PhishDestroy with an elevated risk rating due to confirmed malicious intent. VirusTotal reports detections from 2 out of 95 participating security vendors. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It was created on April 19, 2026, and resolves to IP address 185.114.97.3. The SSL certificate is issued by Let’s Encrypt, which is commonly abused by threat actors to appear legitimate. Given the recent domain creation and low detection rate, this suggests a newly established phishing campaign with potential to evade early-stage blocklists. The combination of low vendor detection, recent registration, and reputable SSL issuer highlights a sophisticated tactic leveraging trust signals to bypass security controls.

Users are strongly advised to avoid interacting with gemor.cfd or any subpages. Do not input credentials, personal data, or financial information on this domain under any circumstances. Organizations should immediately block gemor.cfd and the associated IP (185.114.97.3) at network and DNS levels. Enable multi-factor authentication (MFA) on all accounts, especially those linked to email or financial services, to mitigate credential theft. Report this domain to your IT security team and consider contributing to threat intelligence platforms such as PhishDestroy to enhance collective defense. Always verify URLs via trusted sources before clicking and inspect SSL certificates for anomalies. Monitor network traffic for connections to this domain or IP as part of incident response protocols.