gxh5[.]geminis-pro[.]com

Analysis of gxh5.geminis-pro.com shows a newly registered domain (created 21 Feb 2026) that was hosted behind Cloudflare’s network (ASN 13335, IP 104.21.11.209, United States). The site presented the page title “Gemini”, and the threat profile lists it as a crypto‑scam impersonating the Gemini financial service. Registration was performed through GoDaddy.com, LLC, and the domain is currently taken offline. Technical fingerprints include mandatory HSTS, support for HTTP/3, and an SSL certificate issued by Google Trust Services under the WE1 intermediate, confirming TLS termination at Cloudflare.

Nameservers nile.ns.cloudflare.com and rihana.ns.cloudflare.com resolve to the same Cloudflare edge. Reputation scoring is extremely low: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal recorded 14 positive detections out of 93 scanned engines. The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. These signals collectively indicate a high‑confidence malicious infrastructure aimed at luring victims into a Gemini‑related cryptocurrency fraud.

Uncertainty remains regarding the exact content that was served before the takedown, as no page capture is available. Defenders should continue to block the domain at network perimeter filters, update DNS‑sinkhole lists, and monitor for any re‑registration attempts of the same sub‑domain pattern. Incident response teams should also flag any authentication attempts to Gemini services that originate from the associated IP range, and consider adding the domain hash to internal threat intel repositories for future correlation.