ggeminilogine[.]webflow[.]io

The domain ggeminilogine.webflow.io was identified as a high-risk brand impersonation threat targeting Gemini, a cryptocurrency exchange platform. Analysis confirms the domain was designed to mimic legitimate Gemini login pages, with the specific page title 'Gemini Login | How to Sign in - Your Crypto Exchange Account.' The domain is currently offline, but prior activity indicates malicious intent to harvest user credentials or sensitive financial information. Infrastructure analysis reveals the domain was registered through Webflow and resolved to the IP address 104.18.36.248, hosted on infrastructure associated with Cloudflare, Inc. in Canada. The domain was created on March 29, 2026, and secured with an SSL certificate issued by Google Trust Services (WE1). Detection metrics indicate significant malicious activity, with 20 of 95 security vendors on VirusTotal flagging the domain as phishing. Additionally, the domain appears on three security blocklists and is explicitly blocked by multiple threat intelligence feeds, including PhishDestroy and MetaMask. Google Safe Browsing also classified the domain as phishing. Current status confirms the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the risk of reemergence or similar campaigns remains high. Organizations and users are advised to block the domain and its associated IP address (104.18.36.248) at the network perimeter. Security teams should monitor for indicators of compromise, including unauthorized access attempts or anomalous login activity linked to Gemini-branded phishing domains. End-users should verify the authenticity of login pages by cross-referencing URLs with official sources and enabling multi-factor authentication for all financial and cryptocurrency accounts.