geminilogienei[.]webflow[.]io

This domain, geminilogienei.webflow.io, is a confirmed phishing site designed to impersonate Gemini, a cryptocurrency exchange platform. The site presents a fraudulent login page titled 'Gemini Login - Gemini Login: Securely Access Your Digital,' mimicking the legitimate Gemini interface to deceive users into entering their account credentials. Such impersonation attacks typically aim to harvest sensitive information, including usernames, passwords, and potentially multi-factor authentication codes, which can be exploited for unauthorized access to victims' digital assets or personal data. Analysis indicates the domain was created on February 21, 2026, and is registered through NameCheap, Inc. Infrastructure review reveals it resolves to the IP address 104.18.36.248, hosted on Cloudflare's network (AS13335). The domain is flagged by 17 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent, as encryption is commonly used by threat actors to lend an appearance of legitimacy to phishing sites. Users who may have visited geminilogienei.webflow.io or entered credentials on the site should take immediate action. First, revoke any active sessions on the legitimate Gemini platform and change the account password using a secure device. Enable multi-factor authentication if not already active, and monitor the account for unauthorized transactions or suspicious activity. If financial or personal data was entered, consider reporting the incident to relevant authorities or the legitimate service provider. Additionally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads.