geoamanilogin[.]webflow[.]io

The domain geoamanilogin.webflow.io is impersonating the legitimate cryptocurrency exchange Gemini, posing a high-risk brand impersonation threat. This website attempts to deceive users into believing they are interacting with Gemini by mimicking its page title and branding. Such impersonation can lead users to disclose sensitive information, including login credentials or financial data, resulting in potential fraud or theft.

This threat is confirmed by VirusTotal, where 17 out of 95 security vendors have flagged geoamanilogin.webflow.io as malicious. The domain resolves to the IP address 104.18.36.248 and uses an SSL certificate issued by Google Trust Services, lending it deceptive credibility. The website’s page title, "Buy, Sell & Trade Bitcoin & Other Crypto Currencies with ... - Gemini," is crafted to lure cryptocurrency users into a false sense of security. Despite these indicators, the domain remains active, increasing risk exposure for potential victims.

If someone has visited geoamanilogin.webflow.io, it is critical to immediately cease any interaction with the site and avoid entering any personal or financial information. Users should verify their Gemini account activity directly through the official Gemini website or app to check for unauthorized access. Changing passwords, enabling two-factor authentication, and monitoring financial accounts for suspicious transactions are strongly recommended. Users should also report the domain to cybersecurity authorities and their antivirus providers to help mitigate this ongoing threat.