en-gmini-log[.]pages[.]dev

The domain en-gmini-log.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which is hosted within the Cloudflare network (AS13335) in the United States. The site presents a page title of "Gemini Login® | Secure Access to Your Crypto & NFTs," indicating a direct attempt to impersonate the Gemini brand and lure users seeking access to cryptocurrency or NFT accounts. VirusTotal has recorded 11 detections out of 95 security vendors, reinforcing the malicious nature of the domain. Google Safe Browsing classifies the URL as social engineering, and PhishDestroy has already added it to its blocklist, which is the sole blocklist currently listing the domain.

Additional reputation signals include a Gridinsoft trust score of 0 out of 100, a clear indication of high risk, and an HTTP 403 response, suggesting that the site is presently inaccessible but may have been operational before being taken offline. The SSL certificate is issued by Google Trust Services under the WE1 certificate, confirming that the domain uses a valid TLS certificate, a tactic commonly employed to increase user confidence. Detected technologies such as HSTS, Cloudflare services, and HTTP/3 further confirm that the infrastructure leverages modern web protocols to appear legitimate.

The domain is flagged for brand impersonation targeting Ethereum users, despite the page title referencing Gemini, indicating a possible cross‑brand strategy to broaden the attack surface. Defenders should immediately block the domain and its associated IP address, monitor for related subdomains under the pages.dev namespace, and update existing phishing and malware detection rules to incorporate the observed page title and SSL issuer details. Continuous monitoring of Cloudflare‑hosted assets for similar patterns is advised, as the infrastructure can be rapidly replicated for new phishing campaigns.