gemiieniilogin[.]webflow[.]io

The domain gemiieniilogin.webflow.io was identified as a brand impersonation phishing resource targeting Gemini, a cryptocurrency exchange platform. Analysis confirms the domain hosted a fraudulent login portal mimicking Gemini’s official interface, designed to harvest user credentials. The page title, 'Gemini Login: Trading Exchange Platform,' directly aligns with the impersonated brand’s branding, increasing the likelihood of deception among unsuspecting users seeking legitimate trading services. Infrastructure analysis reveals the domain was registered through Webflow on March 26, 2026, and resolves to the IP address 104.18.36.248, located in Canada and associated with Cloudflare, Inc. Detection metrics indicate elevated risk, with 12 of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, further corroborating its classification as a phishing resource. The use of a content delivery network and a reputable registrar infrastructure suggests an attempt to evade initial detection while maintaining operational persistence. As of the latest assessment, gemiieniilogin.webflow.io has been taken offline, likely due to enforcement actions by security providers or the hosting platform. However, the risk of reemergence under a similar domain remains elevated. Organizations and users are advised to monitor for domains impersonating cryptocurrency exchanges, particularly those leveraging free hosting services or content delivery networks. Implementing domain-based blocking at the network level, alongside user education on recognizing brand impersonation tactics, is recommended to mitigate future exposure. Security teams should prioritize monitoring for newly registered domains containing variations of 'gemini' or other targeted brand names.