gemini-login-n[.]typedream[.]app

Analysis of the domain gemini-login-n.typedream.app, observed on July 23, 2026, indicates that the site was deployed to impersonate the Gemini digital‑asset exchange. The HTTPS certificate is issued by Google Trust Services under the WE1 label, confirming that the domain leveraged Google’s public‑key infrastructure. An HTTP request returned a 404 status code, meaning the page body was not served at the time of inspection, yet the page title "Official Site® | Gemini Login® | Digital Asset Exchange®" was captured, demonstrating that the operator intentionally crafted a title that mirrors Gemini’s branding. The domain resolves to IP address 104.21.37.85, which belongs to AS13335, Cloudflare, Inc., and is geolocated in the United States.

Technical fingerprints show a stack comprising Node.js, React, Next.js, Google Cloud services (including Cloud Trace and Cloud CDN), Cloudflare edge caching, and Webpack, all typical of modern web applications. VirusTotal reports that 15 of 95 scanning engines flagged the domain, suggesting malicious characteristics, and the domain appears on a single external blocklist. It has been recorded as a crypto‑scam impersonating Gemini and is currently listed as offline. Registration was performed through Cloudflare, Inc., but authoritative name server data could not be retrieved (NS_NOT_FOUND).

The evidence confirms that the infrastructure was deliberately designed to lure users seeking Gemini login access, likely to harvest credentials or facilitate crypto‑related fraud. Uncertainty remains regarding the exact payload or credential‑capture mechanisms because the site returned a 404 and no page content was captured. Defenders should immediately block the domain at perimeter filters, add the IP 104.21.37.85 to deny lists, and monitor DNS for re‑registration. Continuous re‑scanning with multi‑engine services is advised to capture any future changes, and threat‑intel feeds should be updated to reflect the observed indicators of compromise.