ggamenlogeny[.]webflow[.]io

This domain, ggamenlogeny.webflow.io, is flagged as a high-risk cryptocurrency phishing site designed to impersonate the Gemini cryptocurrency exchange platform. The page title, 'Ɠemini^ Login* - Buy, Sell, And Store Various #Cryptocurrencies,' explicitly mimics the branding and login interface of the legitimate Gemini service, likely aiming to deceive users into entering sensitive credentials or wallet information. Analysis indicates the presence of a cryptocurrency drainer kit, which is commonly used to automatically siphon funds from compromised wallets upon user interaction with the fraudulent site. Infrastructure analysis reveals several critical technical indicators associated with this domain. The domain was registered on March 06, 2026, through MarkMonitor, Inc., and resolves to the IP address 172.64.151.8, hosted on Cloudflare's network (AS13335). Security vendor detections on VirusTotal stand at 20 out of 95, indicating a significant level of consensus regarding its malicious nature. The domain appears on three security blocklists, including PhishDestroy and MetaMask, and is currently blocked by multiple threat intelligence feeds. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is frequently exploited by phishing sites to lend an air of authenticity. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure remains a residual risk, as threat actors may redeploy the domain or migrate the phishing kit to alternative hosting. Users who may have interacted with this site are advised to immediately revoke any connected wallet permissions, transfer assets to a secure wallet, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators of compromise to prevent future access attempts.