geasex[.]com

PhishDestroy identifies geasex.com as an active fake login phishing domain designed to harvest user credentials under the guise of a legitimate crypto platform. The domain presents a high risk due to its recent registration, low trust indicators, and absence of detections on VirusTotal, suggesting it is either newly deployed or deliberately evasive. Users attempting to access this domain may unknowingly submit sensitive login details to threat actors, leading to unauthorized account access, crypto theft, or identity compromise. Immediate verification through PhishDestroy is strongly advised before interacting with the site.

This domain was flagged with a seed identifier of cfbb52 as part of an ongoing threat intelligence investigation. Technical indicators show it was registered through Metaregistrar BV on March 30, 2026, resolving to IP address 104.21.80.98. The domain currently shows 0 detections out of 95 on VirusTotal, indicating it remains undetected by most antivirus engines. No confirmed inclusion on major blocklists such as Google Safe Browsing, PhishTank, or OpenPhish was found during initial analysis. The SSL certificate is issued by Let's Encrypt, providing basic encryption but not a reliable trust indicator for legitimacy. The domain’s recent creation date and lack of historical data further suggest opportunistic deployment for phishing purposes.

To mitigate the risk of credential theft or account compromise from this fake login page, PhishDestroy recommends the following actions: First, avoid accessing geasex.com or any linked login portals entirely. If you previously entered credentials, immediately change passwords on all related accounts and enable two-factor authentication where possible. For crypto users, transfer assets from any wallets linked to the compromised credentials to a new, secure wallet. Report the domain to your cybersecurity team or via PhishDestroy’s reporting tool to aid in broader threat intelligence sharing. Monitor financial and personal accounts closely for unauthorized activity following any potential exposure. Finally, share this advisory with colleagues or contacts who may have interacted with the domain to prevent further victimization.