gemeiniloginin[.]webflow[.]io

This domain, gemeiniloginin.webflow.io, is flagged for high-risk brand impersonation targeting Gemini, a cryptocurrency exchange platform. Analysis indicates the page mimics the legitimate Gemini login interface, presenting itself under the title 'Gemini Login - Cryptocurrency Exchange' to deceive users into submitting credentials or sensitive financial information. No explicit drainer kit signatures have been identified at this stage, though the infrastructure aligns with credential-harvesting campaigns observed in prior cryptocurrency-related phishing operations. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.18.36.248 and is hosted on a platform utilizing SSL certificates issued by Google Trust Services. The domain was originally registered on May 08, 2013, through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. Detection metrics from VirusTotal indicate 12 out of 95 security vendors classify this domain as malicious. No entries were found in Google Safe Browsing at the time of analysis, though this does not preclude prior or intermittent blocklisting. As of the latest assessment, gemeiniloginin.webflow.io remains active and continues to pose a significant risk to users. No takedown actions have been confirmed, and the domain’s hosting on a reputable content delivery network complicates mitigation efforts. Users are advised to verify domain authenticity by cross-referencing with official Gemini communication channels and to avoid interacting with unsolicited login prompts. Organizations should update blocklists with the provided indicators and monitor for credential reuse attempts originating from compromised accounts.