geminns-cdnn-web[.]pages[.]dev

Analysis of geminns-cdnn-web.pages.dev indicates this domain was actively flagged as a credential phishing threat before being taken offline. The domain, registered through Cloudflare on February 21, 2026, resolved to a Cloudflare IP (188.114.97.3, AS13335) in the United States and used Cloudflare nameservers (hera.ns.cloudflare.com, lex.ns.cloudflare.com). Its SSL certificate was issued by Google Trust Services (WE1), and the site enforced HSTS and HTTP/3 protocols. At the time of assessment, the domain returned an HTTP 403 status with a page title explicitly stating 'Suspected phishing site | Cloudflare,' confirming its classification by the hosting provider.

Security vendors detected the domain as malicious, with 11 of 93 engines on VirusTotal flagging it prior to takedown. It also appeared on at least one security blocklist, and Gridinsoft assigned a trust score of 0/100. The scam type was identified as credential phishing, though the specific brand or service targeted remains unconfirmed due to limited page content analysis. No evidence suggests the use of a known phishing kit or additional infrastructure beyond Cloudflare hosting.

Defenders should treat this domain as a confirmed phishing resource. While currently offline, historical resolution to Cloudflare IPs and prior malicious detections warrant blocking at the network and endpoint levels. Organizations using Cloudflare Pages should review logs for connections to geminns-cdnn-web.pages.dev between February and July 2026, particularly for credential submission attempts. Further investigation may be required if the domain reappears under altered infrastructure.