ge-mini-log[.]pages[.]dev

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users into disclosing authentication credentials. Analysis indicates the domain specifically targets cryptocurrency platform users by presenting a fraudulent Gemini login interface, as evidenced by the page title 'gemini login' and the impersonation of the 'across' brand. The threat type aligns with credential harvesting campaigns, where attackers exploit trust in well-known platforms to capture sensitive account information. Infrastructure analysis reveals the domain ge-mini-log.pages.dev was registered through Cloudflare, Inc. on February 21, 2026, and currently resolves to the IP address 172.66.47.7. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains to avoid browser warnings. Detection metrics show 18 out of 95 security vendors on VirusTotal have flagged this domain, while it also appears on one security blocklist. The domain was subsequently taken offline, though its prior activity and detection rates suggest a coordinated effort to evade initial scrutiny. Mitigation against this specific threat type requires heightened user awareness and technical controls. Users should verify domain authenticity by cross-referencing URLs with official platform domains and inspecting SSL certificates for discrepancies. Organizations are advised to implement multi-factor authentication (MFA) to reduce the impact of credential theft, alongside domain monitoring tools to detect newly registered lookalike domains. Network-level protections, such as blocking known malicious IPs (e.g., 172.66.47.7) and enforcing real-time threat intelligence feeds, can further mitigate exposure to brand impersonation campaigns. Given the domain's detection history, security teams should treat any prior interaction with ge-mini-log.pages.dev as a potential compromise requiring credential rotation and account review.