login[.]geminihub[.]xyz

The domain login.geminihub.xyz was registered on 2026-03-05 through DNSPod, Inc. and resolves to the IP 199.7.140.158, which is announced by AS979 NetLab Global in the United States. No TLS certificate is presented, indicating the site was served over plain HTTP at the time of takedown. The page title returned by the live host before it was taken offline reads “Gemini 官方原版镜像 · 登录”, directly referencing the Gemini brand and suggesting a login portal. The domain is classified as a crypto‑related brand impersonation campaign targeting Gemini users, consistent with the listed scam type “Crypto Scam”.

VirusTotal scans show four of ninety‑five antivirus engines flag the host, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already listed the domain as malicious. The lack of an SSL certificate, combined with the use of DNSPod’s default nameservers (point.dnspod.net and stormy.dnspod.net), aligns with common infrastructure choices observed in rapid‑deployment phishing kits. The current operational status is offline, but the infrastructure footprint remains observable and could be reused for further campaigns.

Defenders should add the hostname and its resolving IP to internal blocklists, monitor DNSPod name‑server activity for similar patterns, and enforce strict URL filtering for any Gemini‑related login URLs. Users should be warned that any unsolicited request to “login.geminihub.xyz” is likely fraudulent, and legitimate Gemini services only operate under official Gemini domains. Continued vigilance is advised, as the hosting provider and ASN have been used in prior impersonation attempts.