gemithi[.]com

The domain gemithi.com was registered on March 09, 2025 through NameCheap, Inc. and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IPv4 address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are athena.ns.cloudflare.com and coby.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The site presented a TLS certificate issued by Let’s Encrypt (R13) and the page title observed during the brief crawl reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Gemithi”, suggesting a cryptocurrency exchange facade. The activity has been classified as brand impersonation targeting the decentralized finance platform 1inch.

The threat is recorded with an elevated risk level. Detection evidence includes a block by PhishDestroy and inclusion on a single security blocklist. VirusTotal scans returned two positive detections out of ninety‑five vendors, confirming that at least a subset of security products have identified the domain as malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. Publicly available intelligence does not disclose the exact payload or credential‑harvesting mechanisms used, nor does it provide screenshots of the page content beyond the title.

Consequently, the precise technique employed to lure victims remains unverified. However, the combination of a cryptocurrency‑oriented page title, a low‑trust SSL certificate, and the impersonation of 1inch aligns with known patterns of crypto‑draining phishing campaigns. Defenders should continue to block the domain at network perimeter and DNS layers, update endpoint and web‑gateway signatures to reflect the two VirusTotal positives, and monitor for additional domains registered with the same registrar or hosting on the same Cloudflare IP range.