gemini-balance.fly2me.cc
Category: Phishing And Fraud
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of gemini-balance.fly2me.cc
The domain gemini-balance.fly2me.cc appears to host a single-page login or verification portal branded as "Gemini Balance." Based on the page title, visible interface, and linked project resources, it may be presenting itself as a balance-check or account-verification page related to the Gemini cryptocurrency brand. The homepage screenshot shows a minimal form asking for a verification token, with Chinese-language interface text and footer links to documentation, source code, and a messaging channel.
Based on the domain structure and page content, this does not appear to be an official primary domain for Gemini. Instead, it appears to be hosted on a third-party subdomain under fly2me.cc and may be tied to a publicly shared template or toolkit referenced through external documentation and code-hosting links. The site is categorized by multiple web-classification providers as phishing or fraud-related at the time of this scan.
Safety Assessment for gemini-balance.fly2me.cc
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 12 out of 91 security engines, and several web-classification providers categorized it as phishing or fraud-related. In addition, the domain closely resembles gemini.com and may be a look-alike intended to imitate the Gemini brand. The page itself shows a simple credential or token-entry form rather than a full corporate website, which is consistent with common phishing patterns.
The malware scan did not detect malicious files in the sampled page resources, and major content-malware threat databases listed in the scan were clean at the time checked. However, that does not outweigh the broader phishing indicators. The domain's IP address is also listed on one mail-reputation blocklist, which is a weaker signal on its own but adds minor caution in context.
Taken together, the combination of multi-engine phishing detections, brand resemblance, lack of established traffic presence, and a login-style interface on an unrelated domain suggests this website may pose potential risks to visitors. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL/TLS certificate issued by a mainstream certificate authority, with expiry shown as 2026-09-26. It is served through Cloudflare infrastructure on IP address 104.21.58.23, with Cloudflare nameservers and hosting geolocated to Canada in the scan data. DNSSEC appears to be unsigned.
From a technical standpoint, the page is lightweight and the malware scan reported 0 flagged files out of 6 scanned resources, with no flagged external links or iframes in that sample. Even so, valid HTTPS and clean static resources do not by themselves establish legitimacy, especially when the domain naming pattern and reputation signals suggest possible impersonation or phishing activity.
Share your experience with this website. Was it safe? Did you encounter any issues?