Gemini Cites You. Your Report Credits Medium.
· Published August 11, 2026 · Updated August 15, 2026 · 5 min read
If your content lives on somebody else’s domain, do not trust a Gemini citation report unless the vendor follows the redirect.
That is the whole finding. Everything below is the evidence for it.
TL;DR
- Gemini cites through a Vertex AI redirect that hides the real publisher.
- The common workaround reads the publisher from the citation title. Across 595 citations we have now measured, the title was a bare domain every single time, so the workaround looks like it works.
- It does not. The title gives you the registrable domain and drops the subdomain. On a shared platform the subdomain is the publisher.
- The link is correct. The label is wrong. Gemini cited you; your report credited Medium.
- The defect is universal. The damage is not. It only bites where the subdomain identifies the publisher.
The label, not the link
Nothing here is broken from a reader’s point of view. Gemini links to the right page. What arrives in a measurement pipeline is a redirect URL plus a title, and the title is where the attribution comes from.
That title is precise about the wrong unit. It gives you medium.com when the page is certik.medium.com.
For most publishers that costs nothing. developers.uniswap.org arriving as uniswap.org is still Uniswap. For anything published on a platform, the publisher is exactly the part that got dropped.
Where it breaks
We followed the redirects on every platform-hosted citation in our first sample:
| Title says | Redirect resolves to | Who that is |
|---|---|---|
medium.com | certik.medium.com | CertiK, audit firm |
medium.com | slowmist.medium.com | SlowMist, security firm |
medium.com | peckshield.medium.com | PeckShield, security firm |
medium.com | quillaudits.medium.com | QuillAudits, audit firm |
substack.com | blockcrunch.substack.com | Blockcrunch, crypto media |
Five publishers, collapsed into two platforms. Any classification scheme built on the title then files four named security auditors as generic media.
We checked whether this is a crypto problem. It is not, and it is
The first sample was 429 citations from crypto safety questions. That is a narrow slice, so we ran a second set on ordinary consumer and technical questions: project management software, running shoes, retirement accounts, cloud costs, iron deficiency.
The mechanism reproduced exactly. 166 of 166 citations returned a bare registrable domain as the title. Same behaviour, unrelated topics.
The damage did not. Zero of those 166 citations sat on a shared platform. Gemini cited company sites, universities, NIH, Reddit and YouTube. Domains whose owners are the publishers. Nothing to lose.
So the two claims separate cleanly:
- The format defect is a property of Gemini’s citation payload. It happens everywhere.
- The attribution loss depends on where your industry publishes. Crypto security research lives on Medium. Project management vendors and medical institutions own their domains.
The 4% is not a constant
Our first sample needed a network call on 16 of 429 citations, or 4%. That number has been quoted back to us as a rate. It is not one.
On the non-security sample the equivalent figure was 0%, because no citation landed on a platform at all. Budget the fetch by how much of your category publishes on shared domains, not by our number.
Who actually loses
Not the reader. The person counting.
If you publish on Medium, Substack, GitHub Pages, Notion, Ghost, GitBook, WordPress.com or Blogspot, Gemini is citing you and your visibility tool is crediting the platform. Two consequences follow:
- You undercount your own citations, possibly to zero, on exactly the content you invested most in.
- The platform looks enormous. Aggregate a category this way and Medium appears to be a dominant source when it is a mailbox.
The fix
Resolve the redirect where the subdomain carries meaning. Keep an explicit platform list rather than fetching everything.
Never guess. An unresolvable citation is recorded as unresolved, not dropped and never assigned to google.com.
Record how each one resolved, so a disputed classification can be checked rather than argued.
How we verified it
We took 25 stored citations at random and followed each redirect to its final host. All 25 were reachable, which also settles a practical worry: these links do not expire on the timescale a study runs over. Twenty matched the title exactly. The five that disagreed are in the table above, and every disagreement was subdomain-level rather than a different publisher.
The title is not unreliable. It is precise about the wrong unit.
What this does and does not claim
This is a finding about the DataForSEO route to Gemini, which is how much of the AI visibility tooling market gets its data. We have not tested the direct Google API.
One case remains untested. We tried four developer and startup topics, where Medium and Substack publishing is common and the damage should be largest. Gemini declined to search on all eight runs, returning no citations at all. So the scenario most likely to show the problem is unproven, and we would rather say that than infer it. Worth noting on its own: across our non-security testing, Gemini refused to search on 8 of 12 questions.
We are not claiming anyone else’s numbers are wrong. We are saying that a tool resolving Gemini citations from the title alone understates every publisher on a shared domain, by construction. That is checkable, and we would rather it be checked.
What to do
If you buy AI visibility reporting, ask one question: how do you resolve Gemini’s Vertex redirects, and do you preserve the subdomain? If they read the domain off the title, every platform-published source in your report is credited to the platform.
This is one of the traps in step four of our AI visibility audit method, which is mapping the sources an engine cites in your place.
And if you publish research somewhere other than your own domain, this is the argument for a canonical copy you control.
Revision history
- Reframed around the general finding rather than the security-firm case. The measurement is unchanged at 595 citations; the earlier framing presented a subdomain-stripping defect as though it only affected security audit firms, when it affects anyone publishing on a platform host.
- Published.
