gemini-website-new[.]webflow[.]io

PhishDestroy identifies gemini-website-new.webflow.io as an active crypto drainer posing as the Gemini cryptocurrency platform. Webflow-hosted domains are frequently abused for impersonation campaigns, and this site follows that pattern, using deceptive branding to trick users into connecting crypto wallets. The site leverages the legitimate Webflow infrastructure to host malicious JavaScript payloads designed to drain cryptocurrency assets upon wallet connection.

This domain presents multiple red flags detectable through basic forensic analysis. It resolves to IP 104.18.36.248 and is served via Google Trust Services SSL, a tactic often used to appear legitimate. Registered through Cloudflare, the domain was created recently and flagged by 14 out of 95 VirusTotal security vendors. It has been blocked by OpenPhish and appears on one additional blocklist. Despite these warnings, the site remains active, indicating ongoing malicious operations.

As of the latest assessment, gemini-website-new.webflow.io continues to operate with elevated risk. Users are strongly advised to avoid interaction and verify any suspicious link using PhishDestroy’s real-time scanning tool. While current blocklists provide partial protection, the site’s persistence suggests a need for heightened vigilance. Remaining risk is assessed as elevated due to active distribution and credible impersonation tactics.