wenexchange[.]pages[.]dev

The domain wenexchange.pages.dev has been identified as an active brand impersonation campaign targeting users of the cryptocurrency platform Gemini. This malicious site mimics the legitimate service’s branding to deceive visitors into entering sensitive credentials or downloading fraudulent software. PhishDestroy’s telemetry shows the domain resolves to IP 188.114.97.3 and holds a valid Google Trust Services SSL certificate, increasing its appearance of legitimacy while concealing its malicious intent.

Security assessments conducted by PhishDestroy reveal that wenexchange.pages.dev remains undetected by 95 security engines on VirusTotal (1/95 detections), indicating a low immediate detection rate despite clear threat indicators. The domain is registered through Cloudflare, Inc., leveraging the provider’s free pages.dev subdomain service to rapidly deploy impersonation pages. It currently appears on two enterprise blocklists and has been blacklisted by Enkrypt and ScamSniffer, two leading anti-scam browser extensions. Additional analysis confirms the infrastructure is linked to a known pattern of Gemini-themed phishing campaigns observed since early 2024.

Users who have visited wenexchange.pages.dev should immediately check for unauthorized access to their Gemini accounts or linked cryptocurrency wallets. Disconnect from any sessions initiated on this domain, run a password reset on all associated accounts, and scan endpoints for potential credential harvesting malware. Report the domain to Gemini support and disable browser extensions that may have accidentally allowed connection. Forward any suspicious transactions or login attempts to the platform’s fraud team immediately. Avoid interacting with this domain and use only verified links from the official gemini.com domain for all transactions.