gemaniloginwel[.]pages[.]dev

This domain, gemaniloginwel.pages.dev, is flagged for brand impersonation targeting Gemini, a cryptocurrency exchange platform. Analysis indicates the site mimics Gemini’s official support documentation, as evidenced by the page title 'Gemini Apps Help — 1500-Word Guide (support.google.com/gemini),' which closely resembles legitimate Gemini resources. The domain does not currently exhibit overt crypto drainer functionality but is designed to deceive users into believing it is an official Gemini help portal, likely for credential theft or social engineering purposes. Infrastructure analysis reveals the domain was registered on March 25, 2026, through Cloudflare Pages, a service often abused for rapid deployment of malicious sites. It resolves to the IP address 188.114.97.3, hosted under Cloudflare, Inc. in Canada. The domain appears on 1 security blocklist (PhishDestroy) but remains undetected by Google Safe Browsing and has a VirusTotal score of 0/95. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious sites. As of this report, gemaniloginwel.pages.dev remains active and under investigation. No takedown or sinkholing actions have been observed, and the domain continues to resolve. Users are advised to treat this domain as malicious and avoid interaction. Organizations should update blocklists to include this domain and its resolving IP. Given the lack of detections on major security platforms, additional monitoring is required to assess whether this campaign will expand or evolve into a more aggressive threat, such as a crypto drainer or credential harvesting operation.