gemmineligin[.]webflow[.]io

This domain, gemmineligin.webflow.io, poses a brand_impersonation threat specifically targeting Gemini, a cryptocurrency exchange platform. The domain hosts a fraudulent login page titled 'Gemini® Login: Empowering Digital Investors with Trusted,' designed to deceive users into entering sensitive credentials, such as usernames, passwords, and potentially two-factor authentication codes. The page closely mimics Gemini's legitimate interface, increasing the likelihood of successful credential harvesting for unauthorized account access or financial theft. Analysis indicates the domain is flagged by 18 out of 95 security vendors on VirusTotal, confirming its malicious nature. It resolves to the IP address 172.64.151.8, hosted on infrastructure belonging to AS13335 (Cloudflare, Inc.) in the United States. The domain is registered through Webflow and appears on at least one security blocklist. Despite its current offline status, the domain's infrastructure and historical activity remain a concern for potential reuse or rebranding under a different name. Users who visited gemmineligin.webflow.io or entered credentials on the site should immediately take corrective action. Reset passwords for Gemini and any other accounts where identical or similar credentials were used. Enable multi-factor authentication (MFA) if not already active, and monitor accounts for unauthorized transactions or suspicious activity. If financial information was entered, consider contacting the relevant institution to report potential fraud. Additionally, scan local devices for malware, as credential-harvesting pages may deploy additional payloads.