ggmriloguny[.]webflow[.]io

This domain, ggmriloguny.webflow.io, is flagged as a confirmed credential harvesting site specializing in brand impersonation of the Gemini cryptocurrency exchange. Analysis indicates the infrastructure was specifically designed to mimic Gemini's authentication portal, as evidenced by the page title 'Gemini $Login - Your Gateway to Secure Digital Asset Management.' The domain appears engineered to harvest login credentials and sensitive financial information from users attempting to access digital asset management services, representing a direct threat to cryptocurrency account security. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to IP address 172.64.151.8 hosted by Cloudflare in California, with a creation date of April 01, 2026, suggesting either backdated registration or potential domain squatting. VirusTotal detection metrics show 21 out of 95 security vendors flagging the domain as malicious, while it appears on one known security blocklist. The domain was registered through Webflow's platform, which is commonly exploited for rapid deployment of phishing infrastructure due to its ease of use and built-in hosting capabilities. Current status indicates the domain has been taken offline, though residual risk remains elevated due to the sophisticated nature of the credential harvesting attempt. Response actions should include monitoring for similar infrastructure patterns, particularly domains using Webflow hosting with cryptocurrency-related keywords. Users who may have interacted with this domain are advised to immediately rotate credentials for any cryptocurrency exchange accounts and enable multi-factor authentication. The combination of brand impersonation, credential harvesting focus, and Cloudflare-hosted infrastructure suggests this was part of a coordinated campaign targeting digital asset holders.