ganiimlogin[.]webflow[.]io

On July 23, 2026, the domain ganiimlogin.webflow.io was identified as a brand‑impersonation site targeting Gemini. The page title returned by the HTTP service is “signing In - Gemini”, indicating an attempt to lure credentials. The domain was created on 5 March 2026 and is registered through MarkMonitor, Inc., a registrar commonly used for legitimate brand assets, suggesting the attackers leveraged a reputable registrar to increase perceived legitimacy. DNS resolution points to the IP address 172.64.151.8, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. An HTTP GET request returns a 404 status, implying that the malicious landing page is no longer publicly reachable; the current status is reported as taken offline.

The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming a valid SSL chain but not providing any assurance about the content hosted behind the certificate. Threat intelligence from PhishDestroy has already added the domain to its blocklist, and the domain appears on one additional security blocklist. VirusTotal analysis shows that 18 of 94 scanning engines flagged the domain as malicious, reinforcing the suspicion of credential‑phishing activity. The scam type is classified as credential phishing, and the site explicitly impersonates the Gemini brand, as indicated by the page title and the “impersonates: gemini” tag. Open questions remain regarding the exact phishing kit used, the extent of victim exposure, and whether any active command‑and‑control infrastructure was associated with the domain before it was taken down.

No public Safe Browsing or OTX entries were cited in the supplied data, and no additional payload hashes have been released. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any residual traffic to the IP address 172.64.151.8, and enforce multi‑factor authentication for Gemini accounts.