geminijt[.]com

Analysis of geminijt.com, created on December 03, 2025 and registered through NameSilo, LLC, shows a clear alignment with a Gemini brand impersonation campaign. The domain resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is serviced by the Cloudflare nameservers betty.ns.cloudflare.com and darwin.ns.cloudflare.com, and no TLS certificate is presented, indicating the site operates without HTTPS encryption. The only observed page element is the title "GEMINI," matching the targeted brand name.

Google Safe Browsing has flagged the site for social engineering, and the domain appears on the PhishDestroy blocklist, confirming external recognition of malicious intent. VirusTotal scans report that four of ninety‑five security vendors flagged the domain, reinforcing the suspicion despite a low detection count. Gridinsoft assigns a trust score of 0 out of 100, effectively rating the site as untrusted.

The site is currently listed as offline, which prevents direct inspection of payloads or login forms, but the recorded indicators are sufficient to classify the domain as a high‑confidence brand impersonation threat. Defenders should immediately block geminijt.com at perimeter firewalls and proxy devices, incorporate the domain into internal threat‑intel feeds, and monitor for any resurgence or related domains leveraging the same registrar or Cloudflare infrastructure. Continuous review of Cloudflare‑hosted assets associated with the IP 188.114.96.3 is recommended, as adversaries may reuse the hosting environment for future campaigns.