gemiminngoliz-2[.]gitbook[.]io

This domain is flagged as a high-risk cryptocurrency phishing site targeting users through credential harvesting. Analysis indicates the page title, 'Ɠemini Login | Sign In - Ɠemini💎,' mimics a legitimate cryptocurrency exchange to deceive victims into entering sensitive login credentials. The threat type is classified as generic_phishing with a specific focus on cryptocurrency theft, leveraging social engineering tactics to exploit user trust in well-known platforms. Infrastructure analysis reveals the domain was registered on March 14, 2026, through Cloudflare, Inc., and resolves to the IP address 104.18.40.47, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious domains to appear legitimate. Detection metrics show 19 out of 95 security vendors on VirusTotal flag the domain as malicious. It is blocked by at least three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is explicitly labeled as phishing by Google Safe Browsing. The domain is currently offline, but its prior activity and infrastructure remain a significant risk. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (104.18.40.47) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain name, IP address, and SSL certificate issuer into security monitoring tools to detect and prevent access. Users who may have interacted with the domain should be instructed to reset credentials for any cryptocurrency-related accounts, enable multi-factor authentication, and verify wallet addresses before conducting transactions. Security teams should also monitor for lateral movement or unauthorized access attempts stemming from compromised credentials.