gemniilloginn[.]webflow[.]io

The domain gemniilloginn.webflow.io is currently active and engaged in brand impersonation targeting Gemini, a cryptocurrency exchange platform. Analysis confirms this domain is designed to deceive users by mimicking the official Gemini login interface, specifically presenting the page title 'Gemini® Login: Empowering Digital Investors with Trusted.' The threat type is classified as brand impersonation, with a high risk of credential theft or financial fraud for unsuspecting visitors. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., and resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). The domain creation date is listed as May 08, 2013, though the malicious activity appears to be a recent development. Security vendors have flagged this domain as malicious, with 19 out of 95 VirusTotal vendors detecting it as phishing infrastructure. Additionally, the domain appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. Google Safe Browsing has also classified this domain as phishing. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is frequently exploited by threat actors to lend credibility to fraudulent sites. Current status indicates the domain remains active and poses a significant risk to users. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to prevent interaction. Users who may have visited this domain should immediately reset credentials for any associated accounts, particularly those linked to cryptocurrency platforms. Security teams are encouraged to monitor for similar impersonation domains leveraging the Webflow.io subdomain structure, as this tactic is increasingly common among threat actors targeting financial services. Proactive threat hunting for related indicators of compromise, such as the IP address 104.18.36.248, is recommended to identify potential lateral movement or additional malicious infrastructure.