zamminilogin[.]webflow[.]io

The domain zamminilogin.webflow.io has been identified as a confirmed brand impersonation phishing site, specifically targeting users of the cryptocurrency platform Gemini. The site is currently offline, but its recent activity posed a significant threat to unsuspecting visitors. This domain was registered through MarkMonitor, Inc. and created on March 1, 2026, giving it a very short lifespan before being taken down. It resolved to IP address 172.64.151.8 and was issued an SSL certificate by Google Trust Services (WE1), which likely contributed to a false sense of legitimacy.

Security analysis reveals that this domain was flagged by 17 out of 95 security vendors on VirusTotal, indicating strong consensus among threat detection platforms regarding its malicious nature. Additionally, it appeared on one security blocklist, further confirming its reputation as a threat. The page title was "Gemini Login: - Sign_In," a clear attempt to mimic the Gemini login interface and steal user credentials. The domain was hosted on Webflow, a legitimate platform, which attackers exploited to host their phishing page.

Although zamminilogin.webflow.io is now offline, users who may have visited the site should change their Gemini passwords immediately and enable two-factor authentication if not already done. It is crucial to remain vigilant against such impersonation attempts and always verify URLs before entering sensitive information. PhishDestroy recommends using official bookmarks or direct navigation to trusted websites rather than clicking on links from emails or messages. Monitoring accounts for unauthorized activity is also advised.