bus[.]gomia[.]xyz

Analysis indicates that the domain bus.gomia.xyz was registered through Go Daddy, LLC on 21 February 2026 and resolved to the Cloudflare‑hosted address 172.67.215.194, ASN 13335 (Cloudflare, Inc.) located in the United States. The site presented the page title “Gemini Business2API”, and the brand target field identifies Gemini, confirming a brand‑impersonation campaign aimed at cryptocurrency users. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal records show four of ninety‑three scanning engines flagging the domain, reflecting a modest but non‑trivial detection rate. The domain appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious reputation.

Infrastructure analysis reveals the domain uses the Cloudflare nameservers rayne.ns.cloudflare.com and venkat.ns.cloudflare.com; no TLS certificate was observed, indicating the site operated without HTTPS. Gridinsoft assigned a trust score of zero out of one hundred, and the overall scam classification is listed as a crypto scam. The current status is offline, which limits immediate interaction but does not remove the threat to downstream users who may have cached URLs or received prior communications.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no page content beyond the title has been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host on the same IP or nameserver pair, and ensure that users are warned about unsolicited Gemini‑related communications. Incident response teams should also correlate logs for any recent connections to 172.67.215.194 and consider threat‑intel sharing with partners to pre‑empt similar brand‑impersonation vectors.