securewallet-gemini[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Gemini, a cryptocurrency exchange platform. Analysis indicates the site is designed to deceive users into divulging sensitive credentials, such as login details, private keys, or two-factor authentication codes, by mimicking the legitimate Gemini interface. The threat actor employs social engineering tactics to exploit trust in the Gemini brand, potentially leading to unauthorized access to user accounts and financial theft. Infrastructure analysis reveals the domain securewallet-gemini.com was registered on May 31, 2026, through OnlineNIC, Inc., a registrar frequently associated with malicious domains. It resolves to the IP address 64.89.162.106, which has been linked to prior phishing campaigns. The domain is currently active and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal detection indicates 1 out of 95 security vendors flag this domain as malicious. The SSL certificate is issued by Let's Encrypt (YE1), a common tactic to lend false legitimacy to phishing sites. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address (64.89.162.106) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to securewallet-gemini.com. Users should be educated on verifying domain authenticity, particularly for cryptocurrency-related services, by cross-checking URLs with official sources. Multi-factor authentication (MFA) should be enforced for all accounts to mitigate credential theft risks. Additionally, monitoring for unauthorized transactions or login attempts from unusual locations is recommended for affected users.