gbalance[.]dtemiemie[.]online

Analysis of gbalance.dtemiemie.online indicates the domain was created on 21 February 2026 and is currently taken offline. The site lacked an SSL certificate, meaning any traffic would have been unencrypted before shutdown. DNS resolution points to IP address 199.7.140.22, which belongs to AS979 NetLab Global and is geolocated in the United States. The domain is delegated to Cloudflare name servers arely.ns.cloudflare.com and lennox.ns.cloudflare.com, a common choice for fast‑flux or abuse infrastructure. Registration was performed through DNSPod, Inc., suggesting the registrant leveraged a China‑based registrar that offers bulk domain services.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal records show that 21 of 95 scanned security vendors flagged the domain, providing independent corroboration of its threat profile. The site was listed on at least one public security blocklist and is specifically blocked by PhishDestroy, demonstrating that external mitigation services have already taken action. The page title captured during the brief live interval reads "验证页面 - Gemini Balance," which translates to "Verification Page - Gemini Balance" and aligns with the declared impersonation of the Gemini brand.

The threat classification is a crypto‑related scam, consistent with the page title and the brand target information. While the offline status precludes direct observation of the payload, the combination of a brand‑targeted title, lack of TLS, low trust score, and multiple vendor detections strongly suggests a credential‑harvesting or fund‑extraction scheme aimed at Gemini users. Defenders should add gbalance.dtemiemie.online to URL and domain blocklists, monitor the associated IP 199.7.140.22 for any re‑hosting activity, and enforce strict TLS inspection on outbound traffic to detect any future attempts to serve similar content.