gumini-loggnius[.]godaddysites[.]com

The domain gumini-loggnius.godaddysites.com has been identified as a generic phishing site specifically impersonating Gemini, a cryptocurrency exchange platform. The threat type involves a fake login portal designed to harvest user credentials under the guise of the legitimate Gemini service. As of the latest assessment, the domain has been taken offline, though prior activity and infrastructure analysis confirm its malicious intent. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on November 18, 2013, though recent malicious activity suggests it may have been compromised or repurposed. The domain resolves to the IP address 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendors on VirusTotal have flagged this domain, with 19 out of 95 vendors marking it as malicious. Additionally, the domain appears on one security blocklist, further corroborating its association with phishing activity. The SSL certificate is issued by GoDaddy.com, Inc., which, while not inherently suspicious, aligns with the registrar's infrastructure and does not mitigate the domain's malicious use. Current status indicates the domain is offline, reducing immediate risk to end users. However, the infrastructure remains a potential vector for future abuse. Organizations and individuals are advised to block the domain and its associated IP address (13.248.243.5) at the network level to prevent accidental access. Security teams should monitor for similar domains registered under the same infrastructure or impersonating Gemini, particularly those using homoglyphs or slight variations in the domain name. End users are urged to verify the authenticity of any login portal by cross-referencing the URL with the official Gemini domain and enabling multi-factor authentication to mitigate credential theft risks.