ethereumofficial[.]pro

The domain ethereumofficial.pro was identified as a brand impersonation threat targeting Gemini, a well-known cryptocurrency exchange. Despite its name suggesting a connection to Ethereum, the site was designed to deceive users into believing it was affiliated with Gemini. The page title was misleadingly set to 'Google', likely to evade initial detection. This phishing campaign aimed to steal sensitive information from unsuspecting victims.

Technical analysis reveals significant red flags. VirusTotal flagged the domain with a score of 13 out of 95 security vendors, indicating widespread recognition as malicious. The domain was registered on March 14, 2024, through Hosting Concepts B.V. d/b/a Registrar.eu, and resolves to IP address 142.250.64.100. It appeared on three security blocklists and was found in one AlienVault OTX threat intelligence pulse. The SSL certificate was identified as WR2, further indicating a lack of legitimate security measures.

As of the latest assessment, the domain has been taken offline, reducing immediate risk. However, users should remain vigilant as similar threats may arise. PhishDestroy recommends avoiding any unsolicited communications referencing Gemini or cryptocurrency exchanges. Always verify URLs independently and report suspicious sites. Enable multi-factor authentication and monitor accounts for unauthorized activity.