geminiiellogin[.]gitbook[.]io

Analysis indicates that the domain geminiiellogin.gitbook.io is currently active and was registered on 2026-02-21 through Cloudflare, Inc. The domain resolves to the IPv6 address 2606:4700:4402::ac40:93d1 and is served behind Cloudflare’s network (AS13335). HTTP requests return a 403 status code and the site presents a TLS certificate issued by Google Trust Services (WE1). The infrastructure supports HTTP/3. Google Safe Browsing has classified the URL under the SOCIAL_ENGINEERING category, and VirusTotal records show 11 of 93 scanners flagging the domain. The domain appears on one public blocklist and is actively blocked by PhishDestroy. The site is identified as a brand‑impersonation campaign targeting Gemini and is associated with a cryptocurrency‑related scam. No direct content analysis is available, so the exact phishing page layout and credential‑capture mechanisms remain unverified. Defenders should add the domain to network and email deny lists, enforce DNS‑based filtering, and monitor for related malicious traffic. Continued observation of Cloudflare‑hosted subdomains and rapid triage of new indicators are recommended.