gemini[.]sp18[.]net

This domain, gemini.sp18.net, is identified as a brand impersonation threat targeting the Gemini brand. The domain impersonates Gemini to deceive users into providing sensitive information such as login credentials, personal data, or financial details. This type of threat is designed to exploit the trust users have in the Gemini brand, leading to potential financial loss, identity theft, or unauthorized access to user accounts.

Analysis indicates that gemini.sp18.net has been flagged by 3 out of 95 security vendors on VirusTotal, suggesting a low but notable detection rate. The domain is registered through Xiamen 35.com Information Co., Ltd., a registrar that has been associated with various suspicious activities. The domain resolves to the IP address 85.137.174.79 and uses a Let's Encrypt SSL certificate, which is common among phishing sites to create a false sense of security. Infrastructure analysis reveals the use of Caddy and HTTP/3 technologies, and the domain appears on 3 security blocklists, further indicating its malicious nature. The page title 'Galaxy Trading System' is a clear attempt to mislead users, as it does not align with the Gemini brand. The domain is currently offline, which may indicate that it has been taken down or is being cycled to avoid detection.

If users have visited gemini.sp18.net, they are advised to immediately change their Gemini account passwords and any other credentials that may have been compromised. Users should also monitor their financial accounts and credit reports for any unauthorized activity. It is recommended to enable two-factor authentication (2FA) on all relevant accounts to add an additional layer of security. If any suspicious transactions are detected, users should report them to Gemini and their financial institutions immediately. To avoid similar threats in the future, users should verify the URL of websites they visit, especially those requesting sensitive information, and use security tools that can detect and block malicious domains.