gemini-login-start-byw[.]pages[.]dev

This domain, gemini-login-start-byw.pages.dev, is flagged as a high-risk credential phishing campaign targeting the Google brand. The domain was registered on April 27, 2026, through Cloudflare, Inc., and currently resolves to IP address 188.114.97.3, which is hosted in Canada by Cloudflare, Inc. Its page title is 'Sign Up, Login, and Access Google,' explicitly indicating an attempt to capture user credentials for Google accounts. The domain utilizes Cloudflare's infrastructure, including nameservers beau.ns.cloudflare.com and gemma.ns.cloudflare.com, and supports HSTS and HTTP/3 technologies. An SSL certificate was issued by Google Trust Services. VirusTotal detection data shows 4 out of 91 security vendors flagging this domain, and it appears on one security blocklist. The Gridinsoft trust score is 0 out of 100. The domain remains active with an HTTP 200 status. Defenders should block access to this domain at the network level, add the domain to blocklists for email security gateways and web filters, and monitor for any credential submissions to this site. Users should be warned not to visit the domain or enter any login credentials. The exact page content beyond the title has not been analyzed, but the registration details and hosting through Cloudflare suggest a low-cost, rapidly deployable phishing infrastructure. The campaign is ongoing and should be treated as an active threat.