savoirscom1[.]info

Analysis of www.savoirscom1.info indicates a high‑risk brand‑impersonation campaign targeting the Gemini brand. The domain was registered on March 01, 2026 through NameCheap, Inc., and the associated SSL certificate is issued by Google Trust Services / WE1. Infrastructure inspection shows the domain resolves to 104.21.6.12, an address owned by AS13335 Cloudflare, Inc., with the site served from the United States. Nameservers darl.ns.cloudflare.com and rosa.ns.cloudflare.com are active, and the HTTP response is a 301 redirect, suggesting an attempt to hide the final landing page. Detected web technologies include Bootstrap, jQuery, LiveChat, Cloudflare Browser Insights, and HTTP/3, which are typical of commodity phishing kits. The Gridinsoft trust score of 0 / 100 further confirms a malicious reputation. VirusTotal scans report six of ninety‑three security vendors flagging the domain, and the site is listed on one external blocklist and has been blocked by PhishDestroy. The page title presented by the server – “WARKOP4D : Rekomendasi Link Alternatif Bandar Togel Online Resmi Pertama Di asia Live Draw Sgp” – does not reference Gemini, indicating that the brand lure may be delivered via subsequent redirects or content not captured in this snapshot. Current intelligence does not reveal the exact phishing payload, credential‑collection mechanism, or any associated command‑and‑control infrastructure, leaving those vectors uncertain. Defenders should block the domain and its resolving IP at network perimeter, monitor DNS queries for the listed nameservers, and ensure that any outbound connections to Cloudflare‑hosted addresses are scrutinized. Continuous re‑scanning with multiple vendors is advised to capture evolving detections, and any observed attempts to impersonate Gemini should be reported to the appropriate brand‑abuse channels.