gemini.hrxgxai.com
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of gemini.hrxgxai.com
This website appears to present itself as a login or verification page branded as "Gemini Balance." The page title includes Chinese text meaning "verification page," and the visible interface shows a simple credential or token-entry form with a login button. Based on the linked resources and footer references, the page may be associated with an open-source project or cloned toolkit rather than an official corporate service.
The domain structure is notable because the page is hosted on the subdomain gemini.hrxgxai.com rather than on the well-known Gemini brand's primary domain. The content and naming suggest it may be attempting to imitate a cryptocurrency or financial-service login experience. Based on available page elements, it does not appear to be a full business website with company information, support details, or standard product navigation.
Safety Assessment for gemini.hrxgxai.com
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 15 out of 91 security engines, and several web-classification providers categorized it as phishing or fraud-related. In addition, the domain closely resembles gemini.com in a way that may cause confusion, and the page itself appears to mimic a Gemini-branded verification or login workflow. That resemblance is a meaningful warning sign because newly created look-alike pages may be used to collect credentials, tokens, or other sensitive information.
The malware file scan did not detect malicious files in the sampled content, but that does not outweigh the broader phishing indicators. Phishing pages often contain little or no malware and instead rely on deceptive branding and credential harvesting. The domain is also relatively new, has no meaningful traffic ranking in the provided data, and its IP address is listed on one mail-reputation blocklist, which is a minor additional caution rather than decisive evidence on its own.
Based on these findings, this website may pose potential risks to visitors, particularly anyone asked to enter login details, verification codes, or wallet-related information.
Technical Description
The site is using a valid Let's Encrypt SSL certificate that was active at the time of scanning, which means traffic may be encrypted in transit. However, the presence of HTTPS should not be treated as proof of legitimacy. The server appears to run uvicorn and is hosted on NetLab Global infrastructure at IP address 154.64.243.48 in Los Angeles, United States. DNSSEC is not enabled for the domain.
From an infrastructure perspective, the domain is relatively young at 303 days old and uses Cloudflare as registrar with Cloudflare nameservers. The combination of a young domain, unsigned DNSSEC, minimal page content, and a login-focused interface on a look-alike subdomain may increase concern, even though the sampled page resources and external links were not themselves flagged during the content scan.
Share your experience with this website. Was it safe? Did you encounter any issues?