exh5[.]gemini[.]college

This domain, exh5.gemini.college, was registered through GoDaddy.com, LLC on 26 October 2025 and is configured with the authoritative name servers ns29.domaincontrol.com and ns30.domaincontrol.com. DNS resolution returns the single IPv4 address 45.192.98.61, which belongs to AS401701 (cognetcloud INC) and is geolocated to Hong Kong. No TLS certificate is presented for the host, indicating that the site was served only over HTTP at the time of observation. The page title returned when the site was reachable was simply “Gemini”, matching the brand target “gemini” and the declared scam type of a crypto‑related scheme.

Reputation services have assigned extremely low trust scores: Scamadviser rates the domain 1 out of 100 and Gridinsoft rates it 0 out of 100, both reflecting a high likelihood of malicious intent. The domain appears on a single security blocklist and is listed by PhishDestroy as a blocked entity. VirusTotal analysis shows that 11 of 95 scanned scanners flagged the domain, reinforcing the suspicion of abuse. Current network telemetry indicates the domain has been taken offline, which aligns with the “offline” status reported by monitoring services.

Evidence gaps remain regarding the exact content delivered to victims, the presence of any credential‑harvesting forms, or the use of additional infrastructure such as redirect chains or payload hosting. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any re‑activation, and include the host in threat‑intel feeds. Additional investigation of the IP’s other hosted domains may reveal further campaign elements. Organizations using the Gemini brand should be alerted to the existence of this fraudulent domain and advised to educate users about unsolicited crypto‑investment requests that reference “Gemini” without proper verification.