auth-gemini-com-auth[.]square[.]site

The domain auth-gemini-com-auth.square.site was observed hosting a credential‑collection page that claimed to be a Gemini login interface, as indicated by the page title "Log In | Gemini®: | Sign In | auth-uphlds-com-auth". VirusTotal scans recorded 15 detections out of 93 security vendors, confirming that multiple independent scanners flag the host as malicious. The site employed a Let’s Encrypt certificate (issuer E7) and returned an HTTP 404 response at the time of analysis, suggesting that the phishing page was taken offline before the snapshot was captured. Hosting details show the domain resolves to 74.115.51.5, an address owned by AS27647 (Weebly, Inc.) in the United States, and the DNS configuration lists four Amazon Route 53 name servers (ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, ns-810.awsdns).

The infrastructure also exhibited signatures of Amazon Web Services and Cloudflare, a combination frequently leveraged by phishing operators to provide scalable front‑ends and conceal origin servers. Registration data indicates the domain was created on February 5 2019 and was purchased through MarkMonitor, Inc., a registrar often used for legitimate brand protection, which may complicate takedown efforts. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a credential‑theft vector.

Threat actors appear to have targeted Gemini users with a crypto‑related scam, although the exact payload or monetary mechanism was not captured before the site went offline. Defenders should continue to block the IP address 74.115.51.5, add the domain to local and network‑level deny lists, and monitor for any re‑registration or reuse of the square.site subdomain pattern. Ongoing vigilance is advised, as the underlying hosting providers (Weebly, AWS, Cloudflare) can support rapid redeployment of similar impersonation pages.