TLS SNI Mismatch: Gemini AI Domain Resolving to Non-Google Infrastructure

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•1

This rule detects network traffic where the TLS Server Name Indication (SNI) field claims to be 'gemini.google.com', but the traffic is being directed to a non-Google destination. This is often indicative of an Adversary-in-the-Middle (AiTM) attempt to intercept or redirect traffic intended for legitimate AI service domains.