loggemini-login-us[.]pages[.]dev

This domain loggemini-login-us.pages.dev was observed serving a page titled “Gemini® | Trade, Earn, & Manage Crypto” and is classified as a Gemini brand impersonation crypto scam. The site was created on 21 February 2026 and is currently offline, returning HTTP 451. Hosting is provided by Cloudflare, Inc.; the domain resolves to IP 172.66.46.217, which belongs to AS13335 Cloudflare in the United States. Cloudflare‑managed DNS is evident from the authoritative nameservers jermaine.ns.cloudflare.com and magdalena.ns.cloudflare.com.

The TLS certificate is issued by Google Trust Services under the WE1 CA, indicating a valid HTTPS endpoint, and the server advertises HSTS and HTTP/3 support. Three of ninety‑three VirusTotal scanners flagged the domain, and it appears on a single security blocklist, where it has also been blocked by PhishDestroy. No additional public intelligence such as Safe Browsing or OTX reports is available for this host. The limited evidence suggests the infrastructure was deliberately provisioned to mimic the legitimate Gemini service, leveraging a reputable CDN and a trusted certificate to increase credibility.

Because the site is offline, active payloads cannot be confirmed, and the exact content beyond the page title remains unknown. Defenders should continue to block the domain and its associated IP address, monitor for re‑registration, and add the domain to internal deny lists. Network sensors that flag outbound connections to Cloudflare‑hosted IPs with the Gemini page title should be tuned to generate alerts. Ongoing watch‑listing of the nameservers and certificate issuer can help detect future clones that reuse the same hosting pattern.