gemini-login-hub[.]pages[.]dev

This domain, gemini-login-hub.pages.dev, operates as a fraudulent login portal impersonating the Gemini cryptocurrency exchange. Analysis indicates the site presents a fake authentication interface designed to harvest user credentials, potentially enabling unauthorized access to cryptocurrency accounts. The page title, 'Use Gemini Apps - Computer - Gemini Apps Help - Google Help,' mimics legitimate support documentation to appear authentic, increasing the likelihood of successful deception for users seeking Gemini-related assistance or account access. Infrastructure analysis reveals the domain was registered through Cloudflare on April 06, 2026, and resolves to the IP address 188.114.96.3, located in California and associated with Cloudflare infrastructure. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. Despite its active status, the domain has not yet been flagged by antivirus engines, with 0 out of 95 detections on VirusTotal. It appears on a single security blocklist, indicating early-stage detection by specialized threat intelligence sources. Users who have visited gemini-login-hub.pages.dev or entered credentials on the site should immediately revoke access to any associated Gemini accounts and enable multi-factor authentication if not already active. All passwords used on the site should be changed, and any connected sessions terminated. Monitoring for unauthorized transactions or account modifications is critical, particularly for cryptocurrency wallets linked to the compromised credentials. Organizations should update internal blocklists to include this domain and its resolving IP address to prevent further exposure.