begin-access-ge-mini[.]pages[.]dev

The domain begin-access-ge-mini.pages.dev was registered through Cloudflare, Inc. on 14 March 2026 and resolves to the IP address 172.66.44.59, which is owned by Cloudflare (AS13335) and geolocated to the United States. The site served an HTTPS certificate issued by Google Trust Services under the WE1 intermediate, and the HTTP response returned a 403 status code. Automated analysis detected the presence of HTTP Strict Transport Security, Cloudflare’s edge protection, and HTTP/3 support. The page title observed during the brief capture was “Signing in – Gemini”, indicating an attempt to impersonate the Gemini cryptocurrency exchange. VirusTotal scanned the domain and two of ninety‑four security vendors reported a detection, while Gridinsoft assigned a trust score of zero out of one hundred.

The domain appears on three independent security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL as a credential‑phishing vector. Current operational status is offline, suggesting the phishing campaign has been taken down or is temporarily dormant. Analysis confirms that the infrastructure is typical of fast‑flux‑style phishing operations that leverage Cloudflare’s free tier to hide origin servers. The combination of a recent registration date, a brand‑specific page title, and low trust scores strongly points to a credential‑phishing campaign targeting Gemini users. Uncertainty remains regarding the exact phishing kit used, the presence of any malicious payloads, and whether the domain may be re‑registered for future abuse.

Defenders should add begin-access-ge-mini.pages.dev to internal blocklists and ensure that DNS filtering solutions block the associated IP range 172.66.44.0/24 where feasible. Security teams should monitor Cloudflare‑hosted domains that share the same name servers (dee.ns.cloudflare.com, walt.ns.cloudflare.com) for patterns of rapid registration and similar page titles.