gemini-eth[.]sbs

The domain gemini-eth.sbs is a phishing site targeting users of the Gemini cryptocurrency platform. It has been flagged by 11 out of 91 vendors on VirusTotal as malicious, indicating a significant recognition of its threat potential. The domain is currently offline, reducing its immediate threat, but its previous activity highlights the ongoing risks of phishing attacks in the cryptocurrency sector.

Registered through NameSilo, LLC, gemini-eth.sbs used Let's Encrypt for its SSL certificate, a common choice for phishing sites due to its free and automated nature. The hosting IP was 101.99.80.135. The domain was active for a brief period before being taken down, but during its operational phase, it managed to deceive users by masquerading as the legitimate Gemini platform.

This domain has been included in three public blocklists: PhishDestroy, MetaMask, and SEAL, underscoring the broad awareness and response from various security entities. The impersonation of a well-known brand like Gemini is a typical tactic in phishing campaigns, aiming to exploit the trust users place in established services. Despite its current offline status, the initial success in evading detection highlights the need for continuous monitoring and rapid response to emerging threats.