gemini[.]yuki[.]codes

Analysis of gemini.yuki.codes shows a brand‑impersonation infrastructure targeting the Gemini cryptocurrency platform. The domain was registered through Name.com, Inc. on 21 February 2026 and is currently taken offline. DNS resolution points to the IPv6 address 2606:4700:3030::ac43:cf34, which belongs to the Cloudflare network (AS13335) and resolves to a US location. Four authoritative nameservers are observed: ns2kry.name.com, ns4dls.name.com, ns1cnb.name.com, and ns3cna.name.com. The site presented the page title "验证页面 - Gemini Balance," indicating a verification‑style page in Chinese that references Gemini balances, consistent with the reported crypto‑scam classification.

The SSL certificate is identified as "WE1," though no further validation details are available. The domain appears on a single security blocklist and is specifically blocked by PhishDestroy, confirming external detection of the malicious activity. VirusTotal analysis shows the domain was scanned by 93 vendors; none reported a detection at the time of scanning, but the absence of alerts does not constitute a safety guarantee.

From the available evidence, the primary malicious behavior is the impersonation of Gemini to lure victims into disclosing credentials or transferring funds. The exact content of the hosted page has not been publicly examined, leaving the specific phishing mechanics uncertain. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed nameservers, and monitor for any re‑activation of the IPv6 address. Additional threat‑intel sources should be consulted for potential overlaps with other Gemini‑related campaigns, and any future activity should be correlated with the Cloudflare IP range to assess if the infrastructure is being reused.