geminilogiinn[.]webflow[.]io

This domain is an active brand impersonation phishing site targeting users of the Gemini cryptocurrency exchange. Visitors to geminilogiinn.webflow.io are presented with a fraudulent login interface designed to harvest credentials, recovery phrases, or other sensitive authentication details. The site mimics the official Gemini branding, including logos, color schemes, and page layout, to deceive users into believing they are interacting with a legitimate platform. Such attacks are commonly used to gain unauthorized access to accounts, steal funds, or conduct further fraudulent activities under the victim's identity. Analysis indicates this domain was registered on March 25, 2026, through Webflow, a platform commonly used for website hosting and development. The site is flagged by 17 out of 95 security vendors on VirusTotal, with detections from multiple threat intelligence sources. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, which is associated with Cloudflare, Inc. and located in Canada. The domain appears on three security blocklists, including those maintained by cryptocurrency-focused security providers, further confirming its malicious intent. Users who have visited geminilogiinn.webflow.io or entered credentials on the site should take immediate action. First, revoke any active sessions and change passwords for the legitimate Gemini platform, as well as any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) if not already active. Monitor the account for unauthorized transactions or suspicious activity, and report any anomalies to the official support channels of the targeted service. If cryptocurrency or personal data was exposed, consider reporting the incident to relevant cybersecurity authorities or consumer protection agencies for further guidance.