gemnayilogin[.]webflow[.]io

This domain is flagged as an elevated-risk brand impersonation threat targeting Gemini, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users into submitting login credentials under the guise of legitimate Gemini services, potentially leading to unauthorized account access and asset compromise. Infrastructure analysis reveals the following technical indicators: the domain gemnayilogin.webflow.io is detected by 18 out of 95 security vendors on VirusTotal, with a page title of 'Gemini $Login - Your Gateway to Secure Digital Asset Management.' It resolved to IP address 172.64.151.8 and was registered through MarkMonitor, Inc. The SSL certificate is issued by Google Trust Services (WE1), and the domain creation date is listed as June 15, 2026. The domain appears on one security blocklist and is currently offline, having been blocked by PhishDestroy. To mitigate risks associated with this type of credential theft, users should verify domain authenticity by cross-referencing official communications from Gemini. Enable multi-factor authentication (MFA) on all cryptocurrency exchange accounts to add an additional layer of security. If credentials were entered on this domain, immediately reset passwords and monitor accounts for unauthorized transactions. Organizations should update blocklists with the domain and IP address to prevent access from corporate networks.