gemnnixlogen[.]gitbook[.]io

This domain, gemnnixlogen.gitbook.io, is identified as a generic phishing site impersonating the Gemini cryptocurrency exchange login portal. The page title, "G𝓮miñi : Login | Sign In," uses Unicode character substitution to mimic the legitimate Gemini branding, a common tactic in credential harvesting attacks. No specific drainer kit signatures were observed, but the site structure aligns with phishing templates designed to capture user credentials for financial fraud or account takeover attempts.

Analysis indicates the domain is flagged by 13 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It is registered through Cloudflare, Inc., and resolves to the IP address 104.18.40.47, a Cloudflare proxy endpoint. The domain was created on March 30, 2014, though the malicious content appears to have been deployed recently. It appears on one security blocklist and employs technologies including GitBook, Google Cloud, HSTS, and HTTP/3. The SSL certificate is issued by Google Trust Services, which does not mitigate the phishing risk.

As of the latest verification, the domain has been taken offline, likely due to enforcement actions by hosting providers or security entities. However, residual risk remains as threat actors may re-deploy the phishing kit under a new domain or subdomain. Users who interacted with the site should assume credential compromise and initiate password resets, enable multi-factor authentication, and monitor linked accounts for unauthorized activity. Organizations are advised to block the domain and associated IP (104.18.40.47) at the network level and update detection rules to account for Unicode-based brand impersonation tactics.