event-usual[.]money

Analysis of event-usual.money shows a newly created domain (created 12 August 2025) that was registered through NameSilo, LLC and delegated to the authoritative name servers ns3-ams.v-sys.org and ns4-ams.v-sys.org. The site presented a page title of "Usual Interface" and was classified as a crypto‑scam that impersonates the Gemini brand. Infrastructure observations reveal that the domain resolved to IP address 213.111.154.75, which belongs to AS43641 SOLLUTIUM EU Sp z.o.o. in the Netherlands, a hosting provider frequently associated with malicious activity. The SSL certificate presented is identified as R11, indicating a low‑trust or self‑signed certificate.

Reputation services provide extremely low confidence scores: Gridinsoft rates the domain 0 / 100, while Scamadviser assigns a 1 / 100 rating. VirusTotal scans returned 15 detections out of 93 security vendors, confirming that multiple anti‑malware engines consider the site malicious. The domain appears on two dedicated blocklists, PhishDestroy and ScamSniffer, reinforcing its classification as a phishing‑related crypto scam. Current HTTP status is offline, but historical activity suggests the site was operational before takedown.

Defenders should immediately block both the domain and its resolving IP address at perimeter and DNS filtering layers. Continuous monitoring of the hosting ASN (AS43641) and the associated name servers is advised, as they may host additional related campaigns. Adding the domain to internal threat intelligence feeds and sharing the indicators with upstream security communities will aid in broader detection. Given the low trust scores, multiple vendor detections, and explicit impersonation of Gemini, the site presents an elevated risk of credential harvesting or financial loss for users attempting to interact with the legitimate Gemini platform.