gemninlogine[.]webflow[.]io

This domain, gemninlogine.webflow.io, presents a credential harvesting threat targeting users of the Gemini cryptocurrency exchange platform. Analysis indicates the domain impersonates the legitimate Gemini login interface, presenting a page titled 'Gemini - How to Sign in to Your Crypto Exchange Account - us.' Such impersonation domains are designed to deceive users into entering sensitive credentials, including usernames, passwords, and potentially two-factor authentication codes, which attackers may exploit for unauthorized account access or financial theft. Technical evidence substantiates the malicious classification of this domain. The domain is flagged by 21 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its harmful nature. Infrastructure analysis reveals the domain is hosted on Webflow’s platform and resolves to the IP address 172.64.151.8, located in Canada and associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious domains leveraging Content Delivery Network (CDN) services. Additionally, the domain appears on one security blocklist, further corroborating its association with phishing activity. Users who have visited gemninlogine.webflow.io or entered credentials on this domain should take immediate remedial action. It is critical to revoke any entered credentials by changing passwords on the legitimate Gemini platform and enabling multi-factor authentication if not already active. Monitor the associated account for unauthorized transactions or modifications. If financial or personal data was exposed, consider reporting the incident to relevant authorities and credit monitoring services. Users are advised to verify domain authenticity before entering credentials, particularly for financial or cryptocurrency-related services, and to rely on bookmarked or officially verified URLs.