gemini[.]net[.]au

As of July 12, 2026, the domain gemini.net.au has been confirmed as a high-risk brand impersonation scam targeting the Gemini brand. This domain, created on March 12, 2026, is currently active and has been flagged by 15 out of 95 security vendors on VirusTotal. The domain resolves to the IP address 103.152.248.205, which is located in Australia and is associated with AS133104 Instra Corporation Pty Ltd. Additionally, the domain is registered through Domain Directors Pty Ltd trading as Instra. The page title 'Gemini Management Pages' suggests that the site is designed to mimic legitimate Gemini management interfaces, likely to deceive users into providing sensitive information or engaging in fraudulent transactions related to cryptocurrency. Analysis indicates that the site appears on two security blocklists, further confirming its malicious nature. The SSL certificate, identified as R12, does not provide additional security assurances and may be used to gain user trust. Defenders should immediately block access to this domain and monitor network traffic for any signs of unauthorized activity. Users who have interacted with this site should be advised to change their passwords and review their accounts for any suspicious transactions. The infrastructure analysis reveals a common pattern of using reputable domain registrars and hosting providers to operate the scam, which suggests a level of sophistication and an attempt to avoid detection. Continuous monitoring and timely updates to security measures are recommended to mitigate the risk posed by this and similar threats.