getgems[.]ink

Analysis of the domain getgems.ink, created on 21 February 2026 and registered through NameCheap, Inc., shows that it is being used to impersonate Coinbase for wallet/seed phishing. The domain resolves to the IP address 98.84.224.111, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The authoritative name servers are dns1.p01.nsone.net, dns1.p02.nsone.net, dns2.p01.nsone.net, dns2.p02.nsone.net, and dns3. No TLS certificate is presented, and the site is currently offline.

The page title observed during earlier scans was “Toy Bear #20726 - NFT Marketplace,” indicating that the content was unrelated to Coinbase but may have been leveraged to lure victims. The infrastructure has been listed on two security blocklists, PhishDestroy and ScamSniffer, and two of ninety‑three VirusTotal scanners flagged the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. While the precise phishing page layout has not been captured, the available indicators—domain age, registrar, hosting on a major cloud provider, lack of HTTPS, low trust score, blocklist inclusion, and detection by multiple vendors—confirm that the domain is part of a credential‑harvesting campaign targeting Coinbase users.

Defenders should block DNS resolution to 98.84.224.111, add getgems.ink to URL filtering policies, and monitor for similar NSOne‑hosted domains created after February 2026. Additional investigation of the associated IP range within AS16509 may reveal other related malicious sites. Because the site is offline, real‑time detection is limited, but historical data should be retained for correlation with future incidents.