auth-gemini-logi[.]pages[.]dev

The domain auth-gemini-logi.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline, returning HTTP status 403. DNS resolution points to IP 172.66.44.149, owned by AS13335 Cloudflare, Inc., located in the United States. The domain employs Cloudflare services, including HSTS and HTTP/3, and presents an SSL certificate issued by Google Trust Services under the WE1 label. The page title returned by the server is "Suspected phishing site | Cloudflare," which aligns with the classified scam type of brand impersonation targeting Gemini.

Google Safe Browsing has flagged the site for social engineering, and the domain appears on one security blocklist. PhishDestroy has already blocked the domain. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal analysis shows that 10 of 93 security vendors have flagged the domain as malicious.

The nameservers listed are surina.ns.cloudflare.com and johnny.ns.cloudflare.com. While the infrastructure and certificate details are verified, the exact payload or credential‑harvesting mechanisms remain unknown because the site is offline and no page content has been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and update detection rules to include the observed nameserver pair and the IP address 172.66.44.149. Additional hunting should focus on traffic to Cloudflare‑hosted domains with similar HSTS/HTTP‑3 configurations that exhibit suspicious page titles or trigger Google Safe Browsing social‑engineering alerts.