geminifxnet-work[.]org

Analysis of geminifxnet-work.org confirms its classification as a crypto scam impersonating the Across brand. The domain, registered on June 5, 2025, through Cosmotown, Inc., resolved to IP 163.61.188.5, hosted on AS153568 (NEW DHAKA HARDWARE) in the US. Infrastructure review reveals nameservers under LyteHosting (dns1-4.lytehosting.com), a pattern observed in other fraudulent domains.

No SSL certificate was present, increasing exposure to interception risks. The page title 'Geminifx-Network' aligns with the scam type identified in threat intelligence, though the exact content or phishing kit remains unconfirmed due to the domain's offline status as of July 24, 2026. Detection data shows the domain appears on one security blocklist (PhishDestroy) and is flagged by 2 of 95 vendors on VirusTotal, indicating limited but actionable coverage.

Defenders should treat this domain as malicious, particularly in environments where Across or crypto-related services are used. Recommended actions include blocking the domain and IP at network perimeter devices, monitoring for residual connections from compromised endpoints, and reviewing logs for prior interactions with the domain or its hosting infrastructure. Given the domain's offline status, no immediate user-facing alerts are necessary, but historical log analysis may reveal earlier compromise attempts.