gemunilagina[.]webflow[.]io

This domain, gemunilagina.webflow.io, is identified as a high-risk phishing infrastructure impersonating Gemini, a cryptocurrency exchange platform. The site presented a fraudulent login interface under the title 'Login* - Ɠemini | Exchange Digital Asset - Buy, Sell & Trade,' designed to harvest user credentials for unauthorized access to digital asset accounts. Analysis confirms the domain was operational as a phishing endpoint targeting individuals involved in cryptocurrency trading. Infrastructure analysis reveals the domain resolved to the IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335) in the United States. The domain was registered through MarkMonitor, Inc., with a creation date of May 08, 2013, though the phishing content appears to have been deployed more recently. Security telemetry indicates the domain was flagged by 18 of 95 vendors on VirusTotal, while Google Safe Browsing classified it as phishing. Additionally, the domain appears on two independent security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by Google Trust Services (WE1), provided a false sense of legitimacy to potential victims. As of the latest assessment, gemunilagina.webflow.io has been taken offline, though residual risks may persist if users saved or bookmarked the fraudulent page. Organizations and individuals are advised to monitor for unauthorized access attempts linked to credentials potentially compromised via this phishing site. Network administrators should ensure the domain and associated IP (172.64.151.8) are blocked at the perimeter. Users who interacted with the site should immediately reset passwords for Gemini and any other accounts where identical credentials were reused. Continuous vigilance is recommended, as threat actors frequently redeploy similar infrastructure under new domains.