gemifnilogin[.]webflow[.]io

The domain gemifnilogin.webflow.io is identified as a high-risk brand impersonation threat targeting Gemini, a cryptocurrency exchange platform. This domain specifically replicates the Gemini login interface to deceive users into submitting credentials, potentially leading to unauthorized access to crypto wallets or financial theft. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Analysis indicates the domain was created on May 08, 2013, though recent malicious activity suggests potential compromise or repurposing. It resolves to the IP address 172.64.151.8, hosted on infrastructure associated with Cloudflare, Inc. (AS13335). The domain is flagged by 16 of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. It appears on two security blocklists, PhishDestroy and PhishingDB, and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services, serial number WE1, and the domain is registered through MarkMonitor, Inc., a registrar commonly used for legitimate corporate domains, which may complicate initial trust assessments. Given the domain's current offline status, immediate user interaction risks are mitigated. However, organizations and individuals should remain vigilant for similar impersonation attempts targeting cryptocurrency platforms. It is recommended to monitor for recurring domains using the same infrastructure or registration patterns, particularly those leveraging content delivery networks to obscure origin servers. Users should verify the authenticity of login pages by cross-referencing URLs with official sources and enabling multi-factor authentication on all financial and crypto-related accounts. Security teams are advised to update blocklists with this domain and its associated indicators, including the IP address and SSL certificate details, to prevent future exposure.