geminihospitality[.]in

This domain, geminihospitality.in, is actively impersonating the Gemini brand and has been flagged as a high-risk phishing site. Registered on April 13, 2016, through GoDaddy, the domain resolves to IP address 119.18.54.166, located in India. Analysis indicates the site is still operational despite returning an HTTP 406 status, which may suggest server-side filtering or misconfiguration to evade detection. The domain is currently blocked by at least one security vendor and appears on a single blocklist, though its persistence suggests ongoing malicious intent. Infrastructure analysis reveals the domain uses a Let's Encrypt SSL certificate issued under the YR1 intermediate, a common choice for phishing sites due to its free and automated issuance process. The presence of an MX record (mail.geminihospitality.in) with priority 0 indicates potential email-based attack vectors, such as credential harvesting or business email compromise. Google Safe Browsing has explicitly flagged the domain for social engineering, aligning with its use in brand impersonation campaigns targeting Gemini users. VirusTotal reports that 15 out of 95 security vendors detect the domain as malicious, providing additional corroboration of its phishing classification. While the domain's decade-long registration might appear legitimate at first glance, the combination of active blocklisting, SSL certificate characteristics, and MX record configuration strongly supports its use in fraudulent activity. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for associated email traffic. Further investigation into the hosting provider and IP range may reveal additional linked infrastructure.