welcome-gemini-login-us[.]tem3[.]io

PhishDestroy identifies welcome-gemini-login-us.tem3.io as a live credential phishing domain masquerading as the official Gemini crypto exchange login page to harvest user credentials and session tokens. This domain employs typosquatting tactics by incorporating the recognizable 'Gemini' brand into its subdomain while leveraging a deceptive .tem3.io structure to appear legitimate. The site's primary objective is to trick victims into entering their cryptocurrency exchange credentials, which are then harvested by threat actors for account takeover, fund theft, or sold on dark web marketplaces for further exploitation.

This domain was flagged by 15 out of 95 VirusTotal security vendors, blocked by MetaMask and SEAL security solutions, and currently resolves to IP 188.114.96.3. It was registered through GoDaddy.com, LLC on August 02, 2024, and has already appeared on 2 security blocklists. Despite hosting an SSL certificate issued by Google Trust Services, these credentials do not validate the site's legitimacy, as threat actors frequently obtain free domain validation certificates to enhance their phishing sites' appearance of authenticity.

Users who visited welcome-gemini-login-us.tem3.io should immediately check for unauthorized transactions in their Gemini account and enable two-factor authentication if not already active. If credentials were entered, change passwords on all crypto exchange accounts using a strong, unique password and consider enabling withdrawal whitelists. Report any suspicious activity to Gemini support and scan local devices for malware, as stolen credentials may have been accessed by additional threat actors. Avoid visiting this domain or any similar links, and verify website URLs through official channels before entering sensitive information.