gemniixilogiem[.]gitbook[.]io

Analysis of the domain gemniixilogiem.gitbook.io indicates an active credential-phishing campaign targeting cryptocurrency users. The domain, registered through Cloudflare, Inc., was created on March 30, 2014, though recent malicious activity suggests compromise or repurposing of existing infrastructure. The page title, 'Ɠemini Login | Ɠemini Login,' closely resembles branding associated with a well-known cryptocurrency exchange, though the exact content and functionality of the site remain unconfirmed due to restricted access during analysis. Infrastructure analysis reveals the domain resolves to the IP address 172.64.147.209, which is part of a content delivery network known for providing anonymity and resilience to takedown efforts. The site employs HTTP/3 and is protected by an SSL certificate issued by Google Trust Services, a common tactic to lend legitimacy to phishing pages. Detection metrics indicate moderate awareness within the security community: the domain appears on four blocklists, and fourteen of ninety-five security vendors flagged it in aggregated scans. It is currently blocked by multiple threat intelligence feeds, including SEAL, MetaMask, PhishDestroy, and PhishingDB, which classify it as social engineering. The domain’s trust score is rated at zero by Gridinsoft, reflecting high confidence in its malicious nature. Defenders should treat this domain as an active threat, particularly for users of cryptocurrency platforms. Network-level blocking of the IP 172.64.147.209 and the domain itself is recommended, alongside monitoring for credential reuse or unauthorized transactions originating from exposed accounts. Further investigation into the hosting infrastructure may reveal additional compromised or maliciously registered subdomains under the same parent domain.