geminijalogan[.]webflow[.]io

This domain, geminijalogan.webflow.io, is identified as a brand impersonation phishing site targeting Gemini, a cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing they are interacting with legitimate Gemini services, likely to harvest credentials or distribute malicious payloads. No specific drainer kit signatures were detected, but the infrastructure aligns with known phishing campaigns leveraging cloud-based hosting services. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on February 21, 2026, and resolves to the IP address 172.64.151.8, hosted on Cloudflare's network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was blocked by PhishDestroy. Google Safe Browsing (GSB) status is not explicitly stated, but the domain's offline status suggests prior detection. As of the latest assessment, geminijalogan.webflow.io has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the risk remains elevated due to the domain's recent creation date and the persistent threat of similar impersonation campaigns. Organizations are advised to block the domain and its associated IP (172.64.151.8) at the network level. Users should be alerted to verify domain authenticity before interacting with any Gemini-related services, particularly those hosted on third-party platforms like Webflow. Continuous monitoring for related domains or IPs is recommended to mitigate residual risk.